use the urn form of the checksum instead of passing around the type + digest
wire in a reasonable HTTP response when user-provided checksums don't match