ArcGIS Server (for .NET) generates images, etc. in arcgisoutput, arcgiscache, and arcgisjobs folders. Can the AGS security system (specifically, token-based) be used to secure these folders in the same manner as the REST API? Or do they require a separate strategy? I've pored over the documentation but have found nothing specific to this aspect of AGS security.
Securing the cache directory - this might help in part. It's got nothing to do with token security. Just a way of accessing cache tiles with no virtual directory.