Fix getting attachment streams

* remove the hack (it is not needed anymore)
* use basic auth to get the attachment stream