Secure attachment url function