- Admin - upload only shows up for 'access administration section' perms
- Users without 'upload files' perm do not see the attachments form (and cannot attach even when sending their own http request)
Note: if a user can edit a node, but not 'upload files', then the attachments are left untouched (and cannot be changed).
This makes sense because people will expect attachments to work everywhere when they enable this module. This also matches comment.module's behaviour, where comments are allowed by default unless turned off.