restrict attachment download access to logged in users with the same company