I've done a bit of that for an extranet for a client. It worked OK, but was too slow. In the end we dumped all the code to manipulate the active directory objects and used "net user" calls and similar instead.
"Further to previous reponses, my grandfather, whilst fighting in the Sudan, awoke one morning to find himself facing the spears of a thousand angry tribesmen. Grabbing his service revolver, he fended off three of them before succumbing to the onslaught. His bravery went unrecognised and was never recorded until recently, when we dedicated a bench to him in our local park. You don't see asylum seekers doing that."
We have a thing called "Classlink 2000" which is basically what you're after, I think. However, to my knowledge, it's a piece of software that Viglen only supply to schools. Although, knowing Viglen, it's just another program re-branded to sound like it was designed for a school, so you might be able to find the original, if there was one. Alex would know more about it.
I'm not sure about that. You can install the ADMINPAK.MSI file from a domain controller to manage an AD domain remotely, but the glaring security issues over doing it with a web browser are not even worth thinking about.
Like I said - it can be a bit slow, and as Chris pointed out, security is a major concern. Letting people manipulate user accounts over the internet = bad, so you want to be damn sure that the right people are doing the right things.
