Secure /uploads file

Have you had a look at Roles for the user and authentication plugin?