how to serve private images using django

Question

I am planning on creating a photography website. I have fallen onto a slight issue involving serving my files.

I have tried to use static files but quickly realised that to get to the photo all anyone has to do is find the correct url so that is a no go.

I need a way to be able to only allow access to photos after they have made a payment but I don't know how to do this.

Also I cant find any tutorials out there explaining how to do this properly.

my code so far:

views.py

from django.http import HttpResponse
from django.template import RequestContext, loader
from django.shortcuts import render, HttpResponseRedirect, render_to_response
from paypal.standard.forms import PayPalEncryptedPaymentsForm
from django.core.urlresolvers import reverse
import Photography_Site.settings as settings
from datetime import datetime
from Photo_Webapp import models
from paypal.standard.models import ST_PP_COMPLETED
from django.views.decorators.csrf import csrf_exempt
from paypal.standard.ipn.signals import valid_ipn_received
import os

def index(request):
    pic_01_path = models.Photo.objects.get(picture_id="pic0112015.2.15").display_image#.name)#.replace("./", settings.MEDIA_ROOT + "\\")

paypal_dict = {
    "business": settings.PAYPAL_RECEIVER_EMAIL,
    "amount": "0.01",
    "currency_code": "GBP",
    "item_name": "picture01",
    "invoice": "unique-%s" % (str(datetime.now())),
    "notify_url": "http://127.0.0.1:8000/notify/",
    "return_url": "http://127.0.0.1:8000/return/",
    "cancel_return": "http://127.0.0.1:8000/cancel/",

}
valid_ipn_received.connect(show_me_the_money)

# Create the instance.
form = PayPalEncryptedPaymentsForm(initial=paypal_dict)
context = {"form": form, 'img': pic_01_path}
return render_to_response("Photo_Webapp/index.html", context)


@csrf_exempt
def download(request):
    img = models.Photo.objects.get(picture_id="pic0112015.2.15").full_picture
    context = {'img': img}
    return render_to_response("Photo_Webapp/download_page.html", context)

@csrf_exempt
def paypal_view(request):
    valid_ipn_received.connect(show_me_the_money)

    context = {}
    return render_to_response("Photo_Webapp/paypal.html", context)

@csrf_exempt
def notify(request):
    valid_ipn_received.connect(show_me_the_money)

    context = {}
    return render_to_response("Photo_Webapp/notify.html", context)


@csrf_exempt
def cancel(request):
    valid_ipn_received.connect(show_me_the_money)

    context = {}
    return render_to_response("Photo_Webapp/cancel.html", context)

@csrf_exempt
def return_view(request):
    valid_ipn_received.connect(show_me_the_money)

    context = {}
    return render_to_response("Photo_Webapp/return.html", context)

models.py:

from django.db import models
from django.conf import settings
from django.core.files.storage import FileSystemStorage

private_media = FileSystemStorage(location=settings.PRIVATE_MEDIA_ROOT,
                              base_url=settings.PRIVATE_MEDIA_URL,
                              )

class Gallery(models.Model):
    name = models.CharField(max_length=100)
    #type = models.DecimalField(max_digits=6,
                                  #decimal_places=2)
    def __unicode__(self):
        return self.name


class Photo(models.Model):
    picture_name = models.CharField(max_length=100)
    picture_id = models.CharField(max_length=1000)
    date_time_added = models.CharField(max_length=300)
    price = models.DecimalField(max_digits=6,
                                  decimal_places=2)
    display_image = models.ImageField(upload_to="./imgs",
                                  blank=True, null=True)
    location_took = models.CharField(max_length=1000)
    description = models.TextField()
    gallery = models.ForeignKey(Gallery)
    full_picture = models.ImageField(storage=private_media)

    def __unicode__(self):
        return self.picture_name