Serving media through symlinks - security

I am currently writing a PHP script to serve media (image, audio, video) through HTTPS. Minimal research has indicated that simply reading the file contents and echoing them to the client is not an efficient method. Due to hosting limitations (un-moddable Apache), I am unable to use the X-Sendfile header.

My solution is as follows: Each time a piece of media is accessed, I perform the necessary security checks (login, etc.), and create a symlink to the file in another domain's Document Root. I then redirect the client through a Location: header to the symlink just created. After a certain amount of time, the symlink is deleted, and if the same user wants to access the same piece of media, another symlink is generated. The symlinks therefore act as one-time tokens, which are used to access one piece of media once (or several times if the media requires Content-Range headers).

My question is about the security of this solution. The symlinks are random, and they use the cryptographically secure Random\Randomizer method. But they are sent off as GET URIs, which can be intercepted. Is there a major security risk in the process detailed above? If so, is there a better way of doing this? I thought about updating the .htaccess file to only allow symlink access to the IP address which created the symlink, but this doesn't seem to help if the symlink was created by a shared IP, and the intercepter shares this IP. Thoughts appreciated.