Move HTML attachment rendering to own controller

It was a bit weird that it was mixed up in the normal attachments
controller.
Handle unpublished editions of HTML atachments

Fixes https://www.pivotaltracker.com/story/show/60861864