diff --git a/README.md b/README.md
index c974bf1f..b6a05b22 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# remark42 [![Build Status](https://travis-ci.org/umputun/remark.svg?branch=master)](https://travis-ci.org/umputun/remark) [![Go Report Card](https://goreportcard.com/badge/github.com/umputun/remark)](https://goreportcard.com/report/github.com/umputun/remark) [![Coverage Status](https://coveralls.io/repos/github/umputun/remark/badge.svg?branch=master)](https://coveralls.io/github/umputun/remark?branch=master)
+# remark42 [![Build Status](https://travis-ci.org/umputun/remark.svg?branch=master)](https://travis-ci.org/umputun/remark) [![Go Report Card](https://goreportcard.com/badge/github.com/umputun/remark)](https://goreportcard.com/report/github.com/umputun/remark)  [![Coverage Status](https://coveralls.io/repos/github/umputun/remark/badge.svg?branch=master)](https://coveralls.io/github/umputun/remark?branch=master)
 
 Remark42 is a self-hosted, lightweight, and simple (yet functional) comment engine, which doesn't spy on users. It can be embedded into blogs, articles or any other place where readers add comments.
 
diff --git a/app/main.go b/app/main.go
index 64e4eb79..eb056384 100644
--- a/app/main.go
+++ b/app/main.go
@@ -140,13 +140,13 @@ func New(opts Opts) (*Application, error) {
 		DataService: dataService,
 		Exporter:    exporter,
 		WebRoot:     opts.WebRoot,
-		ImageProxy:  proxy.Image{Enabled: opts.ImageProxy, RoutePath: "/api/v1/img", RemarkURL: opts.RemarkURL},
+		ImageProxy:  &proxy.Image{Enabled: opts.ImageProxy, RoutePath: "/api/v1/img", RemarkURL: opts.RemarkURL},
+		AvatarProxy: avatarProxy,
 		Authenticator: auth.Authenticator{
-			JWTService:  jwtService,
-			Admins:      opts.Admins,
-			Providers:   makeAuthProviders(jwtService, avatarProxy, opts),
-			AvatarProxy: avatarProxy,
-			DevPasswd:   opts.DevPasswd,
+			JWTService: jwtService,
+			Admins:     opts.Admins,
+			Providers:  makeAuthProviders(jwtService, avatarProxy, opts),
+			DevPasswd:  opts.DevPasswd,
 		},
 		Cache: cache,
 	}
diff --git a/app/rest/api/rest.go b/app/rest/api/rest.go
index 21242e2f..3765abde 100644
--- a/app/rest/api/rest.go
+++ b/app/rest/api/rest.go
@@ -37,7 +37,8 @@ type Rest struct {
 	Authenticator auth.Authenticator
 	Exporter      migrator.Exporter
 	Cache         rest.LoadingCache
-	ImageProxy    proxy.Image
+	AvatarProxy   *proxy.Avatar
+	ImageProxy    *proxy.Image
 	WebRoot       string
 
 	ScoreThresholds struct {
@@ -122,7 +123,7 @@ func (s *Rest) routes() chi.Router {
 		Logger(LogNone),
 		tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)),
 	}
-	router.Mount(s.Authenticator.AvatarProxy.Routes(avatarMiddlewares...)) // mount avatars to /api/v1/avatar/{file.img}
+	router.Mount(s.AvatarProxy.Routes(avatarMiddlewares...)) // mount avatars to /api/v1/avatar/{file.img}
 
 	// api routes
 	router.Route("/api/v1", func(rapi chi.Router) {
diff --git a/app/rest/api/rest_test.go b/app/rest/api/rest_test.go
index 9a6ee5c3..d9e7a14c 100644
--- a/app/rest/api/rest_test.go
+++ b/app/rest/api/rest_test.go
@@ -461,6 +461,17 @@ func TestServer_FileServer(t *testing.T) {
 	assert.Equal(t, "some html", body)
 }
 
+func TestServer_Shutdown(t *testing.T) {
+	srv := Rest{Authenticator: auth.Authenticator{}, AvatarProxy: &proxy.Avatar{StorePath: "/tmp", RoutePath: "/api/v1/avatar"}}
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		srv.Shutdown()
+	}()
+	st := time.Now()
+	srv.Run(0)
+	assert.True(t, time.Since(st).Seconds() < 1, "should take about 100ms")
+}
+
 func prep(t *testing.T) (srv *Rest, ts *httptest.Server) {
 	b, err := engine.NewBoltDB(bolt.Options{}, engine.BoltSite{FileName: testDb, SiteID: "radio-t"})
 	require.Nil(t, err)
@@ -468,14 +479,14 @@ func prep(t *testing.T) (srv *Rest, ts *httptest.Server) {
 	srv = &Rest{
 		DataService: dataStore,
 		Authenticator: auth.Authenticator{
-			DevPasswd:   "password",
-			Providers:   nil,
-			AvatarProxy: &proxy.Avatar{StorePath: "/tmp", RoutePath: "/api/v1/avatar"},
-			Admins:      []string{"a1", "a2"},
+			DevPasswd: "password",
+			Providers: nil,
+			Admins:    []string{"a1", "a2"},
 		},
-		Exporter: &migrator.Remark{DataStore: &dataStore},
-		Cache:    &mockCache{},
-		WebRoot:  "/tmp",
+		Exporter:    &migrator.Remark{DataStore: &dataStore},
+		Cache:       &mockCache{},
+		WebRoot:     "/tmp",
+		AvatarProxy: &proxy.Avatar{StorePath: "/tmp", RoutePath: "/api/v1/avatar"},
 	}
 	srv.ScoreThresholds.Low, srv.ScoreThresholds.Critical = -5, -10
 
diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index 05e559f2..5da8fee8 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -8,17 +8,15 @@ import (
 	"strings"
 
 	"github.com/umputun/remark/app/rest"
-	"github.com/umputun/remark/app/rest/proxy"
 	"github.com/umputun/remark/app/store"
 )
 
 // Authenticator is top level auth object providing middlewares
 type Authenticator struct {
-	JWTService  *JWT
-	AvatarProxy *proxy.Avatar
-	Admins      []string
-	Providers   []Provider
-	DevPasswd   string
+	JWTService *JWT
+	Admins     []string
+	Providers  []Provider
+	DevPasswd  string
 }
 
 var devUser = store.User{