Basic controller for attachments
Improve double-click protection behaviour

Whilst we want to disable clicked submit buttons to prevent double
form submission, we still want the input to be sent with the form
payload. To do this, we include a hidden input with the same name and
value as the button. This is necessary because browsers do not
include disabled inputs with the payload.