I would suggest Option 1 also. Much faster file access because the thing asking for the file isn't the SQL server, it's Apache/PHP. So putting files with the servers running Apache/PHP results in fastest response times, not just for session but for anything file content related (PDF files, images, hosted video/audio, SCORM files etc). As Ken mentioned also isolating the SQL server database file storage from the moodledata file storage helps avoid out of space issues and reduces chance of data corruption.