Use current_user_can() in attachments.php