There is currently an issue with the avatar handling that will be fixed in SP1. The avatar support was added to the REST API before the avatars were moved into the new CFS storage framework, and the REST API wasn't updated to the new method.
If you go to the URL returned by AvatarUrl, it will return a 301 redirect to the actual avatar URL (though the URL that it returns is where the issue is). In the SP1 client API, we will have a method on the MembershipService for getting the attachments that you'd be able to use.