Mike-

I can help you partway.  Your question regarding directory browsing is 
actually very easily answered.  All you must do is set the option in IIS 
on the server to not allow directory browsing.  About the other questions, 
I'm not sure.  However if you find an answer elsewhere, please post it 
here, as I am building a very similar page and would like the same 
security.

Thank you!
Grant