Authentication using Apache

I have a directory of image files (.tif's), and pdf's that I want to protect from general access but authenticate and retrieve using php. I've developed authentication code that works fine and I'm using a .htaccess file in the directory with order allow, deny deny from all to restrict access to the images. My php code is // completed authetication // retrieving images // for tiff files header ("Content-Type: image/tiff") readfile($file); // for pdf's header ("Content-Type application/pdf") readfile($file); // gifs header ("Content-type image/gif"); readfile($file); My environment is: Apache 1.3.12 on RH Linux 6.2 php 4.0.2 as a Apache module IE 5 on Windows 98 as a client. I've found that this does not work for tiff and pdf files but works fine for gifs, in other words it works on the IE built in types but not the plug-ins where the browser has to start a helper app. I can change the call to get images to; header ("Location: ".$file); and all file types work fine. Unfortunately this means I have to break my .htaccess restrictions. So I really have two questions here, either does anyone know why my readfile() doesn't work or, failing that can someone give me some advice on the best way to secure my images directory using apache and php authetication? Cheers, Steve.