message: API: Refactor addUserPicture to utilize async
  Also secures the output via user.forUser(currentUser),
  but doesn't alter the functionality / security otherwise.
diff: @@ -316,15 +316,19 @@ export class UserController {
  * @apiError BadRequestError
  */
  @Post('/picture/:id')
  - addUserPicture(@UploadedFile('file', {options: uploadOptions}) file: any, @Param('id') id: string, @Body()
  - data: any, @CurrentUser() currentUser: IUser) {
  - return User.findById(id)
  - .then(async (user: IUserModel) => {
  - if (user.profile.picture && user.profile.picture.path && fs.existsSync(user.profile.picture.path)) {
  - fs.unlinkSync(user.profile.picture.path);
  + async addUserPicture(
  + @UploadedFile('file', {options: uploadOptions}) file: any,
  + @Param('id') id: string, @Body() data: any,
  + @CurrentUser() currentUser: IUser) {
  + let user = await User.findById(id);
  + if (user.profile.picture) {
  + const path = user.profile.picture.path;
  + if (path && fs.existsSync(path)) {
  + fs.unlinkSync(path);
  }
  -
  - const resizedImageBuffer = await sharp(file.path)
  + }
  + const resizedImageBuffer =
  + await sharp(file.path)
  .resize(config.maxProfileImageWidth, config.maxProfileImageHeight)
  .withoutEnlargement(true)
  .max()
  @@ -339,14 +343,14 @@ export class UserController {
  path: file.path,
  size: resizedImageBuffer.info.size
  };
  - return user.save();
  - })
  - .then((user) => {
  - return this.cleanUserObject(id, user, currentUser);
  - })
  - .catch((error) => {
  +
  + try {
  + user = await user.save();
  + } catch (error) {
  throw new BadRequestError(error);
  - });
  + }
  +
  + return user.forUser(currentUser);
  }
  /**
  