When you are on the posting page and you have some attachments for the current post, there are links for these attachments just below the message's textarea (in order to put these attachments inline). But the links don't have the SID appended and then if we click on them, we just see a "You're not authorised..." message instead of the attachment.

EDIT: please read the reply for the real issue