Multiple users accessing a micro using a web browser

All,

I am working on a microcontroller (a PIC32MZ to be specific) which can be remotely accessed over the web. The microcontroller offers a working TCP/IP stack implementation, and I can successfully use a browser to communicate with the microcontroller.

If multiple users are accessing the micro, are there established guidelines on how to securely differentiate between the multiple users?

I would like not to re-invent the wheel ... I looked a little into Basic Access control -- but that is a big no-no ...

I also have a login page working, so I can ask for a userName and a password, but do I have to locally create and maintain data structures to manage the various users?

Given the ubiquitous nature of the problem, I would think (hope) that there are established guidelines on how to differentiate amongst, and manage, multiple users in an embedded environment.

I appreciate your help and assistance.

Sincerely, Vincenzo