[IMP] make attachment data available under public by default

Assuming access rights are correctly configured, this allows providing
downloads for any attachment type, not just to display images via
/website/image.

TODO: unify attachment querying, we've got stuff over both web/ and website/