well, what i do is use mod_rewrite, to pass all URL requests through a common script.
and in that script i do all the login stuff and determine if they are requesting a file or a page, and if it is a file and they are logged in, and they have the rights to view it (you'll probably need to store security writes in a database table for ALL files), i send the right headers and then the file.
this is fairly involved, and requires basically rewriting apache, but in the end you have a kick ass website that you control all the user accounts and everything they can and can't see.