file storage/downloader...

Ok, here's the prolem: I'm trying to create a feature on my site similar to xdrive.com. Basically I want the user to be able to upload a file and have it stored on my server. I also want to have the ability for the user to download the file at a later time. Account authentiaction is handled, no problem, but I have no idea where to put the files. I create a directory, it may be guessed and even the filename might be guessed and any user may be able to download the file, breaking user authentication. If I store the file in a non-apache directory, how does the user download the file? My goal is to have the second scenario work, create a directory for each user for file storage, and somehow get the user to be able to download it after being authenticated. I do not want to use .htaccess files for this, either. I want it to be seemless with the rest of the features of the site. Thanks in advance for any ideas, johnny p.