Allow authenticated users to see hidden attachments

[rreitmann]

~~Currently any attachment/file is marked as hidden, however the public user can still access it, if she comes with the right url. Simply returning a 404 or even better a 403 would hide it from the public user and from the authenticated user since we are offering plain links to the file which are accessed by the browser without the authentication header. We could set a cookie containing the authentication token...~~

[rreitmann]

This is a leftover of #2278

[rreitmann]

Currently any attachment/file is marked as hidden, and the public user cannot access it, if she comes with the url. However the authenticated user can also not access it since the authentication token is not sent via a cookie....