attachment security policy

[Gary Kephart]

I have a site that I've set up as read-only except for users who are in 
a particular group. For the most part, that works well. What doesn't 
seem to work is showing the site logo to users who are not logged in. 
When I try to directly access 
http://mysite.org/attach/LeftMenu/mylogo.png when logged off, I get the 
Forbidden page, where it mentions "It is also possible that JSPWiki 
cannot find its security policy, or that the policy is not configured 
correctly. Either of these cases would cause JSPWiki to block access, too."

Is attachment policy different than page policy? Do you have to be able 
to modify a page in order to view an attachment? What do I need to do to 
fix this? I've read 
https://jspwiki-wiki.apache.org/Wiki.jsp?page=Wiki.Admin.Security and 
don't see anything there that addresses this specifically.

Thanks,
  Gary