Restrict access to private attachments

Attachments are now stored out of the public directory and served via
AttachmentsController#show, so we can control who can access them and who
cannot.
The files were moved from public/uploads/ to private/uploads/.

refs #1272