use attachment secure_url for Attachemnt page