Checking for security holes in my webserver

[LB]

I'm using liblacewing (http://lacewing-project.org/ ) to host a relay server for generic use, and I also have a webserver to host a little control panel when I don't have access to the server. It is password protected, but I wanted extra eyes to help check for security holes or other mistakes.

Here is the relevant code:

void OnGet(Lacewing::Webserver &Webserver, Lacewing::Webserver::Request &Request)
{
	if(Ini("Webserver", "Password") == "Restart the server after changing this!") //If default password hasn't been changed
	{
		Request << "You must change the default password to use the webserver.";
		return;
	}
	if(Ini("Webserver", "Password") == "")
	{
		Request << "The webserver password cannot be blank.";
		return;
	}
	if(std::string(Request.Session("login")) != Ini("Webserver", "Password"))
	{
		Request <<
			"Please enter the password:"
			"<br />"
			"<form name=\"login\" action=\"/\" method=\"post\">"
			"<input type=\"password\" name=\"Password\" />"
			"<input type=\"submit\" value=\"Log in\" />"
			"<input type=\"hidden\" name=\"FormID\" value=\"Login Form\" />"
			"</form>";
		return;
	}
	Request <<
		"<form name=\"logout\" action=\"/\" method=\"post\">"
		"You are logged into the server control panel. "
		"<input type=\"submit\" value=\"Log out\" />"
		"<input type=\"hidden\" name=\"FormID\" value=\"Logout Form\" />"
		"</form>"
		"<br /><br />";
	if(Server.Hosting())
	{
		Request <<
			"<form name=\"relayunhost\" action=\"/\" method=\"post\">"
			"Relay Server: Hosting on port " << Server.Port() << "... "
			"<input type=\"submit\" value=\"Stop Hosting\" />"
			"<input type=\"hidden\" name=\"FormID\" value=\"Relay Unhost\" />"
			"</form>";
	}
	else
	{
		Request <<
			"<form name=\"relayhost\" action=\"/\" method=\"post\">"
			"Relay Server: Not hosting... "
			"<input type=\"submit\" value=\"Try Hosting\" />"
			" Port: "
			"<input type=\"text\" name=\"Port\" value=\"" << Ini("Relay Server", "Port").c_str() << "\" />"
			"<input type=\"hidden\" name=\"FormID\" value=\"Relay Host\" />"
			"</form>";
	}
	if(FlashPolicy.Hosting())
	{
		Request <<
			"<form name=\"flashunhost\" action=\"/\" method=\"post\">"
			"Flash Policy Server: Hosting " << ((FlashPolicyTag*)FlashPolicy.Tag)->XML.c_str() << " on port " << ((FlashPolicyTag*)FlashPolicy.Tag)->HostingPort << "... "
			"<input type=\"submit\" value=\"Stop Hosting\" />"
			"<input type=\"hidden\" name=\"FormID\" value=\"Flash Unhost\" />"
			"</form>";
	}
	else
	{
		Request <<
			"<form name=\"flashhost\" action=\"/\" method=\"post\">"
			"Flash Policy Server: Not hosting... "
			"<input type=\"submit\" value=\"Try Hosting\" />"
			" Crossdomain XML File: "
			"<input type=\"text\" name=\"Crossdomain\" value=\"" << Ini("Flash Policy Server", "Crossdomain XML File").c_str() << "\" />"
			" Port: "
			"<input type=\"text\" name=\"Port\" value=\"" << Ini("Flash Policy Server", "Port").c_str() << "\" />"
			"<input type=\"hidden\" name=\"FormID\" value=\"Flash Host\" />"
			"</form>";
	}
	Request << "<br /><br />"
		"<form name=\"disablewebserver\" action=\"/\" method=\"post\">"
		"<input type=\"submit\" value=\"Disable this Webserver Interface\" />"
		"<input type=\"hidden\" name=\"FormID\" value=\"Disable\" />"
		"</form>"
		"<form name=\"shutdown\" action=\"/\" method=\"post\">"
		"<input type=\"submit\" value=\"Shutdown Entire Server\" />"
		"<input type=\"hidden\" name=\"FormID\" value=\"Shutdown\" />"
		"</form>";
}
void OnPost(Lacewing::Webserver &Webserver, Lacewing::Webserver::Request &Request)
{
	if(std::string(Request.Session("login")) == "" && std::string(Request.POST("FormID")) != "Login Form")
	{
		return;
	}
	if(std::string(Request.POST("FormID")) == "Login Form")
	{
		if(Request.POST("Password") != Ini("Webserver", "Password"))
		{
			Request << "Incorrect password.";
			return;
		}
		Request.Session("login", Ini("Webserver", "Password").c_str());
		Request << "Logging in...";
	}
	else if(std::string(Request.POST("FormID")) == "Logout Form")
	{
		Request.Session("login", "");
		Request << "Logging out...";
	}
	else if(std::string(Request.POST("FormID")) == "Relay Unhost")
	{
		Server.Unhost();
		Request << "Stopping Relay Server...";
	}
	else if(std::string(Request.POST("FormID")) == "Relay Host")
	{
		Server.Host(ConvTo<int>::f(Request.POST("Port")));
		Request << "Trying to Host Relay Server...";
	}
	else if(std::string(Request.POST("FormID")) == "Flash Unhost")
	{
		FlashPolicy.Unhost();
		Request << "Stopping Flash Policy Server...";
	}
	else if(std::string(Request.POST("FormID")) == "Flash Host")
	{
		((FlashPolicyTag*)FlashPolicy.Tag)->HostingPort = ConvTo<int>::f(Request.POST("Port"));
		((FlashPolicyTag*)FlashPolicy.Tag)->XML = Request.POST("Crossdomain");
		FlashPolicy.Host(((FlashPolicyTag*)FlashPolicy.Tag)->XML.c_str(), ((FlashPolicyTag*)FlashPolicy.Tag)->HostingPort);
		Request << "Trying to Host Flash Policy Server...";
	}
	else if(std::string(Request.POST("FormID")) == "Disable")
	{
		Request << "Goodbye!";
		Webserver.EnableManualRequestFinish();
		Request.Finish();
		Webserver.Unhost();
		return;
	}
	else if(std::string(Request.POST("FormID")) == "Shutdown")
	{
		Request << "Goodbye!";
		Webserver.EnableManualRequestFinish();
		Request.Finish();
		Webserver.Unhost();
		Server.Unhost();
		FlashPolicy.Unhost();
		throw 1337ull; //Shutdown
//		return;
	}
	Request << "<meta http-equiv=\"refresh\" content=\"1\">";
}

Ini is an instance of a class I wrote that takes an INI in string format and converts it to std::map<std::pair<std::string, std::string>, std::string> format.
Server is of type Lacewing::RelayServer, and FlashPolicy is of type Lacewing::FlashPolicy.
FlashPolicyTag is just a struct that holds the port and hosted XML file, because currently Lacewing::FlashPolicy doesn't have member functions to retrieve that information.
If you need more information, the liblacewing website has good documentation.

Everything works all fine and dandy, I just want to avoid potential security risks.

And yes, I am aware that it doesn't generate valid HTML due to missing <html> and <head> tags, etc. It isn't done.

[LB]

All right, I fixed the really really bad way to initiate a shutdown on line 244...I don't know what I was thinking...