use sha1 instead _id in image url