Radically easy to access on brand approved content for distribution and omnichannel performant delivery. AEM Assets Content Hub and Dynamic Media with OpenAPI capabilities is now GA.
The safest way to do that is on submit of the login html page, validate the username/password, and if successful, stream the PDF file to the response object.