refined permissions on 'update file attachment'