[FIX] security: ir.config_parameter should not be readable by externals
[FIX] security: externals should be able to read attachements

without having the rights to read ir.config_parameter
Merge branch '7.0' of https://github.com/odoo/odoo into 7.0-win32