Anyone can delete attachments

[xknown]

An unregistered user can delete attachments through xmlrpc request:

<methodCall>
  <methodName>wp.uploadFile</methodName>
  <params>
    <param><value>1</value></param>
    <param><value>1</value></param>
    <param><value>1</value></param>
	<struct>
		<member><name>name</name><value>attachement_name</value></member>
		<member><name>overwrite</name><value>1</value></member>
	</struct>
  </params>
</methodCall>

I'll submit a partial fix -- I think that an user should only delete their own uploaded files.

Move user validation before attachment deletion

Looks good to me, but I'm not an XML-RPC guru.

My diff pushes the overwrite feature even further down, to just before the upload gets saved.

(In [5670]) Check the user before overwriting the attachment. Props xknown and Joseph Scott. fixes #4422

(In [5671]) Check the user before overwriting the attachment. Props xknown and Joseph Scott. fixes #4422