If you don't want the file to be accessible without logging in you could do the following:
if($_SESSION['logged_in'] == TRUE){
header("Content-type:" . $content_type);
readfile($path);
}
else{
doStuff();
}
So when the user uploads the file you save the content type and put the file in a location either .htaccess protected or outside of the root folder.
You can save the content type by using:
mime_content_type($file);
Hope this helps.