[WebPub] Wordpress questions

[Lisa C Mayer]

I have two questions for the Webpub crew. I'm builing a site in  
wordpress for my son's preschool  its dev address is http://agassiz.beanisland.com/ 
. I would appreciate your advice on the following:

Is there any way to not have one's wp-content directory show up in the  
url's path for attachments and images? Is there some best practice  
around displaying/not displaying the path?  For example, the PDF for  
the school application is at  http://agassiz.beanisland.com/wp-content/uploads/2009/09/agassizapp_2007.pdf 
  instead of something like http://agassiz.beanisland.com/docs/agassizapp_2007.pdf

Before launching, what security measures should I take or what  
security plugins should I install? This site is not hosted at MIT.

I'm a junior jockey, I know a lot about what wordpress can do but am  
usually on the opposite side of the fence in the dev cycle. So while  
there may be a complex way to implement the first question, my skill  
set may mean I will have to leave well enough alone.

I have also found solutions online to the above questons, but wanted  
your professional advice.

Thanks in advance!
Lisa