A dependency loop exists between class/agent.class.php and
class/group.class.php.  Due to specific `require_once` ordering within
the app, this problem was not surfaced until now.

These two classes depend on eachother, but strictly speaking, the
interpreter needs to read the agent class first.  This is because group
directly inherits from agent.  It is only one of agent's functions which
references group.  Group has a `require_once "class/agent.class.php"` at
its top, so requiring group first will read both classes, in the correct
order, and provide their definition's for the remainder of the runtime.

The main entry-point, index.php, did not have this problem since it was
explicitly requiring group itself (it actually needs group, though).
The df.php entry-point wasn't and was relying on requires in the class/
directory to resolve this issue.  In a more-sane language, I could patch
this more easily directly in the affected file; rather, this patch
updates the df entry-point to explicitly require group, solving the
issue up front.

Hopefully this can be fleshed out in the future as it should not consern
the entry-points that this specific evaluation order needs to take
place.

The third and final entry-point, cron.php, is already fine at the time
of this commit.  Its require tree is much simplier, and does not even
include either of the affected classes.

It is necessary to use double-quotes in the Content-Disposition header.

Now, if a mesg guid is requested under attach/, the attachment file is
served and offers the browser the content-disposition for that file.

Added optional parameter for resource's filename.  If given, a
Content-Disposition header will be delivered to the client.

Entry point df.php, meaning dynamic file or direct file, added as a
means of serving user-supplied content while enforcing access-controls
in PHP.