Restricting /assets to non logged in users

You need to move them and make a PHP-reader class, that you point your <img> tags to.

So all users visits e.g /assets/myimage.jpg will actually visit an Controller named Assets that will look for myimage.jpg inside your hidden folder, check if they are logged in and display it, by reading the entire image into memory and setting jpeg headers.