How do I hide the real filename?
You can use apache module mod-auth-token (https://code.google.com/p/mod-auth-token/) to generate a one-time url. Please refer to the documentation for more specific instructions (there is both apache configuration and php example how to use it).