Ok, after digging more, I did find a reference in help about creating users for the web:
Maintenance Forms
No user, role, or restriction set maintenance forms are available for web projects. Therefore, all users, roles, and selected permissions must either be set using the SecurityDialog in a windows form, or must be set via custom forms created within your web project to maintain user permissions and roles.
Case A) As mentioned before, if the database is hosted remotely (with web server), and the user doesn't mind using the Windows version of "Security Editor", how can he access the remote database if he doesn't have the Enterprise Server? Can SF offer a "one User" SE for this case?
Case B) For us to re-write custom web form to accomplish what the Window version does, requires a good understanding of the inner parts of this system. And that takes time and that was the reason for buying the security system to save time. Why can't we have web form version similar to what ASP.Net offers for their security system, where you can maintain users and permission via web forms?
Thanks!
..ßen