My understanding is that the poster wants to allow a CGI to print out the file (presumably because the CGI handles password protections itself), but wants to make sure that the file isn't available without going through the CGI.