include private attachments if authenticated