    public function downloadAttachment($key='download', $id)
    {
        if ($key != null && $key != 'download') {
            $user = $this->checkAuthUser($key);
        } else {
            if (!$this->Auth->user()) {
                throw new UnauthorizedException(__('You are not authorized. Please send the Authorization header with your auth key along with an Accept header for application/xml.'));
            }
            $user = $this->checkAuthUser($this->Auth->user('authkey'));
        }
        // if the user is authorised to use the api key then user will be populated with the user's account
        // in addition we also set a flag indicating whether the user is a site admin or not.
        if (!$user) {
            throw new UnauthorizedException(__('This authentication key is not authorized to be used for exports. Contact your administrator.'));
        }
        $this->Attribute->id = $id;
        if (!$this->Attribute->exists()) {
            throw new NotFoundException(__('Invalid attribute or no authorisation to view it.'));
        }
        $this->Attribute->read(null, $id);
        if (!$user['User']['siteAdmin'] &&
            $user['User']['org_id'] != $this->Attribute->data['Event']['org_id'] &&
            (
                $this->Attribute->data['Event']['distribution'] == 0 ||
                $this->Attribute->data['Attribute']['distribution'] == 0
            )) {
            throw new NotFoundException(__('Invalid attribute or no authorisation to view it.'));
        }
        $this->__downloadAttachment($this->Attribute->data['Attribute']);
    }