@ctietze php can be quite efficient in terms of execution and memory to serve a static file after an autorisation check.
Symfony http component have a static file response that does that very efficiently.
Not sure for apache autorisation and redirection but I'm fairly sure it might be possible as well.