I remember reading merlyn's article way back when, but have forgotten the gist of it.

Nowadays I would be using Mojolicious, and set up an auth-bridge in the Mojolicious router. This would allow you to only serve those PDF files to those who have met the criteria that let's them pass through the authorization bridge. Any other (mis)user won't have access.

There's a little learning curve to Mojolicious, but once you catch on it's so slick you'll be using it all over the place.