limit files not to be larger than 4MB

validate the file sizes of attachments