Fixing permission checks for attachments so that they always occur on an attachment resource, even for ATTACHMENT_CREATE. In that case, the attachment `.id` is simply `None`.
Authored by: cboos 2007-11-15
Parent: [r6158]
Child: [r6160]