cleaned up .url call in attachments controller