Update `post_attachment` and `attachment` endpoints to validate basic permissions (auth vs no_auth)