attachment initial permissions now conform to initial object permissions...

... policy; closes #606