It kind of worked until now, because the email field is disabled, and
thus never accessed.
But better make it clean, by accessing an object (User) where the email
field actually exists.
Make it more reusable, by:
- Renaming `attachment/update` to `attachment/edit`
- Refactoring the CSS styles into their own stylesheet
- Allow to specify the 'accept' option
