I second John's advice, you'll end up using pdfset and then something like <pdf src="path/to/file/avail/without/login">