There is now a plugin available for preventing unauthenticated users accessing images, Discourse Images Guardian:
https://github.com/muhlisbc/discourse-images-guardian
This has been written by @mbcahyono and was paid for by a client, after advertising the job here, we are very happy with the result.