API::Attachment controller "cancan"ed