use content hashes as GridFS file names
fix asset permission checking