use physicalPathToURL and check View permission for backrefs