create_attachment: properly set token

Before submitting the attachment fetch the unique token required for
the POST request.