Regard controller namespace for path in find_by_id_or_redirect.
Create RestrictedAccess module.
Correct assoziation symbols.
Correct user assoziation.
Add restricted access for attachments.