Originally Posted by GrouchyAdmin

Your best bet is doing a passthrough auth; the easiest to implement is a wildcard subdomain which uses a hash which is tested for auth.

Hey, that's kind of how StrongBox works.

If you don't want to require login, use mod_rewrite to test filetype, referrer, and link all movies through a passthrough script. It's trivial to use $_SESSION in PHP and fpassthru.