add authentication for removing attachement