If a user has an '@' in their username it becomes impossible to upload a profile pic. This is because the changepic widget is overly aggressive about URL-encoding user IDs in paths that it sends to the server. It makes sense to URL encode the user ID when making a bare REST call to the user's home path as is done when a new image is first POSTed. However, when the image is cropped, chagepic also URL encodes the path in JSON form data that is sent to the server. This data does not need to be URL-encoded and is in fact never decoded on the back end. The result is that the image to be cropped cannot be found.