Avatar uploads via cUrl? (and generating an 'authenticity_token')

[kosso]

Hi,

I was looking at whether it was possible to POST/upload a new avatar
image via the API.

It is possible for cUrl to post multipart forms with a file upload
from the command line, but looking at the form on the Picture settings
page, there is a hidden field called 'authenticity_token'.

Would it be possible to generate/retrieve this after say, a call to
the 'verify_credentials' method?

This goes further to an idea / proposal for the generation of some
kind of 'token' which an application can use to post on a user's
behalf. This would then mean that external, third party apps never
need to store the user's password.

thx
kosso