I would just make the link point to a php script, then have that script grab the real file once the user has passed auth.
/real_media/download.php?file=song.rm
You then put all your real media files some where outside of your web root so no one can get to them without this script.