delivered at:
 - GET /schema/group => POST schema
 - GET /schema/group?method=put => PUT schema

The following methods now exist for /file endpoints:
GET /<level>/<id>/file/<filename>
    authenticated file download
GET /<level>/<id>/file/<filename>?ticket
    authenticated download ticket request
GET /<level>/<id>/file/<filename>?ticket=<ticket>
    unauthenticated (ticketed) file download
DELETE /<level>/<id>/file/<filename>
    delete file
PUT /<level>/<id>/file/<filename>
    update file metadata (not yet implemented)
POST /<level>/<id>/file/<filename>
    upload file as "body file"
POST /<level>/<id>/file
    upload file as multipart/form-data

The API now delivers an avatar URL for each user, including at
/users/self.
`bootstrap.py dbinit` defaults to generating a Gravatar URL for each
user, if no avatar is supplied in the loaded JSON file.

Multipart uploads