make_href percent-encodes hrefs (an '@' in an email principal becomes
%40), but the backmap compared against the raw PathMapped, so the
rewrite was skipped and the owner's real path leaked -- editing a shared
collection then failed with 403. Compare and rewrite on the quoted form.