users: add unset route for avatar

also add missing tests for avatar and profile locking

src/users.js

@@ -985,7 +985,7 @@ async function getAvatar(user) {
 
 async function setAvatar(user, avatar) {
     assert.strictEqual(typeof user, 'object');
-    assert(Buffer.isBuffer(avatar));
+    assert(Buffer.isBuffer(avatar) || avatar === null);
 
     const result = await database.query('UPDATE users SET avatar=? WHERE id = ?', [ avatar, user.id ]);
     if (result.length === 0) throw new BoxError(BoxError.NOT_FOUND, 'User not found');