Protect static content behind authentication? Hosting static files naked is almost _asking_ for them to be hotlinked.