restricting viewing of file attachments to admins and project members only