Respect make_attachment_public setting

File uploads now respect the make_attachment_public setting; attachments are not forced public.