App Web

https only if the cert is done right (I hate all those sites with defunct certs where the browser wants a confirmation every other day)

I second that with the master/login separation should be the case (again)
AND please allow special chars like .-/&%!.... in the password!