permissions added to attachment, admin now can manage all (in cancan terms)