Did you "print" the string to verify that the produced string is correct?
If you put the produced string URL into a browser does it find the graphic?
The code looks ok, except you can use the session and database global SSJS variables instead of having to invoke facesContext.