Caching mechanism introduced with gerrit #32204 conflicts with DynamicCredentials exact behaviour is still unknown but from what we can observe, as soon as a request hits /users/avatar-X URL, the given URL is 404 (whereas it works with a regular user) and DynamicCredential user is unlogged.