Temporary fix for #4305: Cant preview attached png images on notes; attachment.secure_url returns an url which is accessible

This makes the attached images work correctly, but i'm not using https. I think it is because secure_url starts with the relative_url_root plus '/files' instead of 'upload' (when calling .url)