Currently, adding a new user requires the server admin to manually create the account on the server, but it's a quite burden for both(admin and user) and it can be related with security concern since server admin knows the user's password in plain text.
I think this process should be changed so that user can create their account on the webpage, and server admin can accept/reject the user creation request via admin panel (either CLI or GUI).
I think we should actively move on to atproto oauth (https://tangled.org/zeu.dev/atproto-oauth-deno). Issue #4 suggests to use the did whitelist alongside oauth, so this might help.