The tutorial Publishing to the web has some advice under the heading "Domain lock".
I personally wouldn't bother going much further than that, unless you're willing to enter an on-going DRM arms race.
I wouldn't actually go for the approach of AJAX requesting a file - if you want it to work in preview, you have to configure the AJAX response to work cross-domain, and if it works for any domain, the protection is no longer effective.