i am protecting images in a site, outside a public folder.....when a visitor views an album, i check if that user is a friend, if so, render the gallery. the rendering of the gallery basically just loops through a img tag that makes a call send_file to send the image to the page.
http://mcubed.name/blog/articles/read/9
thoughts?