1) Server: create nonce hash for user. Store in session, cookie (try to avoid this if possible, the user can mess with their cookies), database, etc for that specific user and file combination.
2) Send preloader file
3) Send nonce hash to preloader, which gets stored in a variable (use json/xml/etc via ajax). Use previously defined method for server proxy to make sure that the preloader is actually from your site, and not ripped and placed elsewhere.
4) When a new chunk of your game code is required, the game file should send it's nonce hash with the request (which is NOT hardcoded in, it is initially obtained when the first part of the code loads directly from the server), which the server will match against their specific session before returning the next chunk of code or file. If there is not a match, the server returns false and never sends the rest of the code. You can also log the ip of the request to get a good overview of repeat offenders so you can blacklist them entirely if they have over a certain number of failed requests (like 1000 within a day or so). This usually means they are attempting to scrape your content with an automated script, as most regular human users will never make that many requests within one day. Then you redirect all of the blacklisted ip requests to a picture of dog poop or something equally annoying. If they are dumb enough to try and directly link your content from their site, then they have dog poop pictures all over their site
The trick with this technique is that it requires that you can either dynamically load multiple files, or that you write your code object oriented so that it can request specific objects from the server. You could theoretically do a similar thing with procedural code by requiring the nonce for specific functions to run, however a really dedicated thief could simply decompile your swf and just remove all the pingbacks to the server, which would take a ton of time and effort, but is still doable. If you pass each part of the code as an object directly from the server, they never get the code at all unless they are making a legit request from the correct project home. The other thing you can do is to have all of your code within the initial file, and load images and variables from the database using the ajax nonce pingback as previously mentioned. This will mean that if your code is ripped they can still theoretically run your game, however it's not really going to do anything unless they create an entirely new set of images/sound/variables to run it with. Again, this can be done, but it's a huge pain and not really worth the effort in most cases. The ideal solution would be to do both, so that not only does the game code not load if it's not correct, but the assets don't either. This also lets you very quickly customize game content without directly editing your code, so you can have a designer or animator working on your game without worry of them breaking anything in the codebase, or you could send a different set of criteria based on some user-triggered event (like changing jump physics if they level up or get an item or something, loading a specific animation set based on the character the user picks, loading level tilesets based on the specific level the user is currently on, or whatever else you can imagine).
This is a rudimentary explanation of how premium games and consoles deal with paid content, however it is also useful to keep your stuff in the right place without a thousand rips floating around all over the web.
So in the instance of building out a game hosting site, you would want to create an api that the game devs can hook into automatically so they don't have to tinker with your server code directly, as letting a million people write server side scripts is generally a very bad idea. So instead, you would issue them authorization when they first upload a game, and then create a nonce for them which their game can request over ajax without them having to write out the whole nonce stuff themselves on the server. The best thing to do in this case would be to provide a snippet of code that accomplishes this so they can just plunk it into their project and have it work. You would need to create one for each language you intended it to work with (i.e. flash, javascript, etc), and then just put them in the developer resources section so they can grab them when needed, or alternately create some generalized ajax url they can ping which will check to insure that their project is registered in the system and return their nonce if it is detected. In the case of flash, you could automatically have all games loaded via a preset preloader that already has this built in, so the game can just call the nonce function because it is already loaded by the preloader before the rest of the game loads at all. This would work for content that is only stored on that specific site, but they would need to manually check to insure they are on the right site within their game code or alternately strip it out for a version that would be anywhere else on the web. However if you are going to build a game using this kind of setup, you probably aren't going to store it in a million different places so that's a minor concern. The biggest problem is that this prevents games from being downloaded and played offline. There really isn't any way to prevent theft if you want them offline-playable, and if you intend to let users download your game, you probably shouldn't be worrying about what they are doing with it unless you want to give them some kind of auth key to actually play it, which is another huge effort to set up, and probably not worthwhile for free content.