Even simpler, you could just set .htaccess file that forces Basic Authentication when looking at the pictures. Sure, it's not the most secure thing, but unless you plan to pass your passwords and such via ssl or something, it's insecure, anyway. ;)