users: add unset route for avatar

also add missing tests for avatar and profile locking

src/routes/profile.js

@@ -8,6 +8,7 @@ exports = module.exports = {
     setFallbackEmail,
     getAvatarById,
     setAvatar,
+    unsetAvatar,
     setLanguage,
     getBackgroundImage,
     setBackgroundImage,
@@ -126,6 +127,15 @@ async function setAvatar(req, res, next) {
     next(new HttpSuccess(204, {}));
 }
 
+async function unsetAvatar(req, res, next) {
+    assert.strictEqual(typeof req.user, 'object');
+
+    const [error] = await safe(users.setAvatar(req.user, null));
+    if (error) return next(BoxError.toHttpError(error));
+
+    next(new HttpSuccess(204, {}));
+}
+
 async function getAvatarById(req, res, next) {
     assert.strictEqual(typeof req.params, 'object');