Lighttpd

I am using lighttpd to serve video and apache for application , also using flowplayer.

I configures for mod_secdownload but still I can use url for certain to doqnload view.

Is ther any way i can tell Lighttpd that request is coming from my application server or when i lit lighttpd to server video, it first rusn a php page to check session .

Any idea to secure my video i dont want direct access via url .

Please help, I can donate some $ too , please