thumbnail: Added attachment_download-permission-check (fixed #4)