[cd34]

I would probably suggest you do that with the hidden directory -- that way, you're not creating 6 symlinks for each pageload.

Workable, yes.

Another possibility is generating a hash on the fly that would be verified by some filter module -- of course, hosting this on a server where you can't install a module might be a bit difficult. But, if you display the page with some hash in the filename, your filter module could determine if the hash was valid and serve the file. You MIGHT be able to do this in mod_rewrite with some creative regexp's that look for a particular key.

Many many ways to do it. The question is, which way uses the fewest resources and will hold up to real-world exposure.