How do you intercept a request for a file to check permissions in MVC3?
===

I have file uploads working great on an ASP MVC3 web site. Currently the files are saved in a folder on the web site called "Files". Users can upload any type of file (e.g. myphoto.jpg, mydocument.docx, etc).

When a user uploads a file I store information about the file in a SQL database and who uploaded it etc.

My questions:
1. How do I intercept a GET request to a file URL (e.g. /Files/myphoto.jpg) to see if the user is allowed to view that file? (based on their rights in the application). I don't like the idea of writing a route constraint to check the database before allowing access.
2. Ideally I'd like to store the files in a different location than the web site file location, but somewhere where the website can determine the file and it's location from the request, yet serve it up as if it was at the location requested (correct content-type headers etc).

Any help appreciated.

Thanks in advance.