Using X-Accel-Redirect for protected pictures?

hi,
i would like to only let friends of a user view a users private photo
album. can i use x-accel for this purpose?

could something like this work?

def photos
@photos = UserPhotos.get_all
end

photos.rhtml

for pics in @photos
@response.headers[‘X-Accel-Redirect’] =
“/files/#{pics.public_filename}”
<img [email protected][‘X-Accel-Redirect’] />
end

i dont this this would work. am i close?