Secure display image outside root

To do what you want you should create a 'image' controller and let CI spit out the correct image.

But if you want to prevent hotlinking, perhaps its easier to disable that through .htaccess.