comment attachments are stored privately on S3, download is given a 10 second window via token