just use a sha1 hex digest to avoid problems w/urls and file names