Normalize file_url to prevent private-file access-check bypass

File URLs are normalised before the access check, so a private file cannot be reached through another spelling of its path.