accessing attachments returns http error 403 forbidden