file sha is not the same as ref sha
document contents_url for files