[api] move all attribute handling from source to attribute controller

(where it should have lived from the start)