Static downloads are optimal, needless to say. But if you need an indirect via your webapp layer to do auth you can basically do get_file.php?file=veryprivate.txt, check the cookie, and if it's good you propagate X-Sendfile: veryprivate.txt to apache which will then serve the file as if it were a static download, with ranges that allows resume and all the rest. It's very neat.