- permit reuse of blob where file is trashed (by-hash and chunked) - add hurl test on /api/files/by-hash - add anti enumeration of blob (404 is always blob_not_owned_by_caller)