Authentication and authorization plays a key role in the web world. Going distributed makes information sharing healthier. But only if it's allowed for the know contact it will be healthy. We can very well see this in the existing web world. We have the memberships and roles for ASP.Net web applications. In addition we also have forms authentication and NTLM authentication.
Going smart client is always best. But considering security it has to be more secure since smart clients attract all the people they can be easily prey to security vulnerabilities.