Fix #178: Protect attachment files from unauthorised downloads