Add `attachment` to params whitelist