Drupal 7: How can I restrict that only sender and receiver can download the attached file with the private message?