Some ideas, not all directly related to this:

• Passwords should be encrypted before being stored
• A mechanism on the server application to add/remove users, avoiding having to SSH on to the server would be nice
• Some level of permissions in the application would be nice - Admin/Owner/Viewer restrictions which would dictate would users can do and give finer control