Added authorization for API show attachment endpoint