Add permission check to canDownload() in

MessageAttachmentObjectType.class.php