You've already gotten some great advice and suggestions. My only addition would be the use of a database to keep track of users and passwords. If you set up a database, it's easy to set up a cgi script for adding users, changing passwords, etc. Also, you can keep track of info on users that way, and it's a bit more secure than an unencrypted text file.