I haven’t been able to get IC streaming of large files working (see this thread), so my plan is to redirect the user to the file on an external CDN after making the update on the IC.
You’re right, though. Either way I’ll have to look into a solution like a magic cookie to prevent unwanted downloads. Not sure how I’d do that with an external CDN…