Working (but insecure) attachment download action