The only option I know that is resistant to header snooping (DownloadHelper, Live HTTP headers, etc) is by using RTMP streams, which is a true stream rather then a play-as-you-download stream.
I don't have any experience in deploying rtmp myself, but I know there are multiple solutions out there for playing, like flowplayer:
I know MySpace switched all their artist playlists to rtmp and it's kept basically everyone out - although we can always record the output of the player using desktop software like Audio Hijack Pro:
All this being said, I have seen a commandline rtmp stream ripper, but never got it to work. In the end the best protection is minimum quality rtmp streams.
Hope this helps!