Fix private attachment error handling (use HTTP error codes), fix ACL bugs