profile: do not crash on invalid avatar id

src/routes/profile.js

@@ -130,6 +130,7 @@ async function getAvatarById(req, res, next) {
 
     const [userError, user] = await safe(users.get(req.params.identifier));
     if (userError) return next(BoxError.toHttpError(userError));
+    if (!user) return next(new HttpError(404, 'no avatar'));
 
     const [avatarError, avatar] = await safe(users.getAvatar(user));
     if (avatarError) return next(BoxError.toHttpError(avatarError));