2FA would be great. GAuth is stupid easy to implement, or you could go the hosted route if you like having someone to blame.

Then again, avatars have been broken forever, so I don't think implementing new features is too high on the priority list right now.