Add app-auth authorization to `post_attachment` and `attachment` endpoints