user account object should contain a full URL to the user picture

Because this changes response and what people are expecting, it must use versions built into services.

Take a look at services.versions.api.php in services/docs

Or this code :P

yeah because if you change the user resource directly, peoples clients will break when they update Services.

As an example, this is in the user resource and lets admins choose the version they wish to use for the logout method.

<?php
/**
 *  Update the current user logout callback to the new callback with a better return value.
 */
function _user_resource_logout_update_1_1() {
  $new_set = array(
    'callback' => '_user_resource_logout_1_1',
  );
  return $new_set;
}

/**
 * Logs out the currently logged in user and returns the new user object.
 */
function _user_resource_logout_1_1() {
  global $user;

  if (!$user->uid) {
    // User is not logged in
    return services_error(t('User is not logged in.'), 406);
  }

  watchdog('user', 'Session closed for %name.', array('%name' => $user->name));

  // Destroy the current session.
  module_invoke_all('user_logout', $user);
  session_destroy();

  // Load the anonymous user.
  $user = drupal_anonymous_user();

  return $user;
}

This looks good it adds a new field called url so existing data is still in place. In my view no need for a new version.

Good call marcingy, ignore #2

Committed.