Use avatar.url directly to avoid duplicating the host when the storage returns an absolute URL. Prevents malformed avatar links in live session token responses.