My suggestions:
There should be four different user "states": Admin, GM, Player, and Spectator (or Observer/Lurker/whatever).
Admins are just like GMs, except they can boot and ban other GMs and can't be boot themselves.
GMs have all the normal permissions, plus the ability to change permissions on the fly. They can boot and ban players and spectators.
Common permissions would include:
- Map creation/deletion
Changing topography layer
Changing fog of war
Seeing fog of war as opaque or transparent
Token/stamp/object creation/deletion
Token movement (subdivided into its own list of permissions, like how it is currently; still, a blanket "stop all token movement" would be nice in a pinch)
Drawing tools (and AoE templates)
Whispers
Chat
(probably more that people could think of)
Players also start with most of the permissions, with a couple "off" by default (like the ability to add/change maps). The exact permissions should be configurable in the server window and saved. If a GM was so inclined, it'd be nice to temporarily give players the full powers of a GM by turning on all permissions.
When the server is started, Spectators could be toggled on/off with a checkbox. If they're on, an optional password box should be there for them too. Spectators probably should receive the most minimum of permissions, like being able zoom and scroll around on the map.
Anyway, I think it'd be nice to see EVERY server on the list (like an FPS server browser), but just have the totally-passworded servers greyed-out. It'd also be cool if it tracked how many players were connected to all servers at the same time, so you'd get "Total # of Users: 3607". ^_^[/list]