Update `posts_attachment`/`attachment` validations to validate basic permissions (auth vs no_auth)