As well as being able to disable access to the Lights Out capability via the Web, it would be great to be able to remove the gadget completely - ideally for individual users (i.e. could the remote web access "show" options be extended to allow this level of control?) or not shown for users without access rights. If neither of these is possible, then control by role (user or administrator) would be a good alternative, and even the simple ability to disable this completely would be good (as can then use Windows Phone/Windows 8 apps and remote admin access to Dashboard to provide this capability). A simple workaround (registry, etc.) to disable the remote web gadget would be a reasonable alternative as well.
This would mean that "non technical" users can be granted very limited access to specific capabilities via the web (which for family use would be ideal).