you need to choose if you want web2py to serve files or your webserver. For the "web2py-way", ross and anthony replied to your question pretty well.
If you go with the "webserver" idea (i.e. you have a lot of files, or some large files and you don't want to "stall" web2py threads serving the files), there are some nice implementation of "expiring links" For nginx there is the httpsecurelink module, cherokee has built-in the "hidden downloads" handler, lighttpd has mod_secdownload, etc. Implementations are pretty simple, but achieve a different goal : render links that are valid for a certain amount of time.
