restrict attachment uploads
fix silly error
security enhancements for #270
remove legacy commented out code in the user class