correct url, and change spec for allowed attachments.