avatar: use copy instead of rename

this is safer since rename() might fail with EXDEV on some servers
if /tmp and /home are on different filesystems.

src/users.js

@@ -825,10 +825,11 @@ function setAvatar(id, filename, callback) {
     assert.strictEqual(typeof filename, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    fs.rename(filename, path.join(paths.PROFILE_ICONS_DIR, id), function (error) {
+    // rename() was failing on some servers with EXDEV
+    fs.copyFile(filename, path.join(paths.PROFILE_ICONS_DIR, id), function (error) {
         if (error) return callback(new BoxError(BoxError.FS_ERROR, error.message));
 
-        callback();
+        fs.unlink(filename, () => callback()); // ignore any unlink error
     });
 }