You "could" link to them via a file and, if authorized, redirect them to the document:
- /download.php?file=some.pdf
- /download/some.pdf
In example 1, download.php checks to ensure the user is authorized to download $file, if so, redirect. The second example is the same thing, except multiviews is set in the apache configuration and the string following it the file being requested, it's just a little cleaner....