@robertbrower If you use the avatar icon URL in an image tag (<img src='...'>), the browser will add authentication if available for the domain. However, typically, there will not be any authentication for api.atlassian.com.
To proxy the request here means that you must somehow add authentication to it. For example, you could create a proxy that, when receiving a request for a certain icon on a certain URL (not api.atlassian.com), will fetch that icon from api.atlassian.com with authentication and return it. You can see an example of this in Gabriel’s post (which comes with its own challenges).
There are some posts suggesting replacing the api.atlassian.com domain of the avatar icon URL with the Jira site domain ([my-site].atlassian.net). This works if the user has permission to view the avatar icon (the browser will attach the authentication based on the current user session for [my-site].atlassian.net).
Please watch and vote on this issue: FRGE-680