Don't serve files to those without permission
add javascript file attachments to tickets