remove debug message
prepend route actions with dot to avoid name conflicts
return 404 for json too if values invalid for attachment records