We’ve long had a small static site that we only wanted to be accessible to users signed into our app. Individually signed urls weren’t an option - we’d need to sign all of the links in these html files (and update them when they expired). Since this was a low traffic site in the end we just put a small sinatra app in front of the static content that used a CAS inspired single signon mechanism. How