attachment download proxy without authentication params