Another possibility, if you don't care what the url looks like, is to
encode the date
and a md5 (or other, your choice) checksum in the url. The checksum is formed
by putting a 'secret' where the checksum goes (at the end?) and checksuming
that. When you get a request back, first check the date, since, if it
is expired,
there is no need to perform another checksum. If the date is good, do a new
checksum of the incoming url with the checksum replaced by the 'secret'. If the
result is the same as came in with the request, serve the content, If the sums
don't match, the request has been tampered with, treat it as expired.
Bill