when setting perform_caching to true we also protected the method
-> broke external call of that method. using hide_action instead.

Also moved this into a shared module and changed avatar into singular
resource for groups and me