Serving attachment file securely through PHP