staff can download attachment