allow user to override instance and attachments directly

if overridden, spoofing a request no longer required