So you are saying that I need to create the UI for the web based, but can I use all classes from the Role Based Security to implement my web security?
Yes. The RBS classes can be used to implement your web security.
Do you have any classes that handles cookies and Session State? Remember we are talking web site in here and not win forms.
We do not have classes to handle cookies and sessions outside of the framework logic. What I mean by this is that the BOs are automatically handled for you. Whatever state you leave a BO on one page will be in the exact same state when you go to another page. (assuming they are using the same ApplicationBasePage).
Can you provide some links for users that created a full blown web site with some transactions that are using the SF framework?
StrataFrame is one of them, but without getting conscent from our users I will not post their sites here. I will say, however, that there are some customers that you would know of that have created web applications to manage as many as 1000-4000 sites through a single web application (load balanced across a web farm in some cases). These sites I do not believe are available to the public, but there are some very large web applications that have been created with SF.
Beside the WebForm template that you created in SF, is there any other classes forms that were created just for the web based development?
There are two different web form templates, one that allows a master page to be selected and another that does not. We also have the templates that help you create either a site or an application. You should really be create a web application versus a site as there are many design-time benefits, but you can go either way.