Secure display image outside root

It depends how you are logging your users (or at least recognizing they are logged in). If it is in a cookie, you know the cookie name, just interrogate the cookie using standard php. If you are using a flag in a database table, again just connect to and interrogate the database using standard php. Would that not do what you are looking for?