A media streaming company uses an external Application Load Balancer with Cloud CDN enabled to deliver video content stored in a Cloud Storage backend bucket. Each video is segmented into hundreds of individual files (manifests and chunks) that must all be protected so only paying subscribers can access them. The company wants to authorize access to an entire set of files with a single authorization step per user session, rather than issuing a separate token for every file. Which Cloud CDN access-control mechanism should they use?