Attaching a file to a class (probably not limited to
the user class and not to attaching a file) will check
the permission to create the class linked from (user in
this case) instead of the class linked to (file in this
case).

The reason is that somewhere in the calling hierarchy
to the actual permission check the class (file) is lost
and replaced by the class in the current client (user).

I'll attach a patch which is not very well tested (it
fixes my problem but I have no intensive tests that
it'll not break other things).

Version is 0.8.4