CS fixes
Fixed CSRF validation
Added missing CSRF check
Added missing check on permission to download attachments