- check for attachment replacement, by checking for both 'CREATE' and 'DELETE'; to make this easier, `perm.require` accepts a list of permissions
- use unqualified verbs for the wiki module
- display the Attach button on the wiki view when this is the only possible action