Hey Jeremy. The allow_attachment_display parameter has a detailed description that notes that you are opening a security hole if you set it without setting another parameter (which you haven't set). Did you read the description of the parameter?
-Max