Fixed bad permissions in upload.module:

- Admin - upload only shows up for 'access administration section' perms
- Users without 'upload files' perm do not see the attachments form (and cannot attach even when sending their own http request)

Note: if a user can edit a node, but not 'upload files', then the attachments are left untouched (and cannot be changed).