As of now Roll20 does not seem to support TLS, or at least it defaults to unencrypted password passing. I know it's "only" a beta gaming platform, but I predict that a lot of your users are using passwords that they use for sensitive accounts.
Please implement mandatory (or at least default) HTTPS support as soon as possible. I know like to devs roll their eyes at security people, but this is a disaster waiting to happen.
Also, you're not storing passwords in plain text, are you?
All that said, I think this is an absolutely fantastic idea and, security stuff aside, Roll20 is off to a great start. Keep doing what you're doing!
