attachments work! TODO: validations & security