Hello Heidi, (That's my Wife's name too)
With RMI, the threads are created and handled automatically for you,
but you must be aware that your methods might be called by several
threads, and handle them accordingly.  I suggest reading "Java
Concurrency in Practice" <http://www.javaconcurrencyinpractice.com/>
to learn about the proper ways to handle this.

For your second question, this is no "simple" answer... This is also a
broad topic.
First, you have to store the user id and password.  Preferibly storing
the password in a one-way-function encrypted form.
Second, you *should* try to ensure that the password (in either its
original or encrypted form) is never sent through clear-text.  SSL is
often the appropriate choice.
Third, You have to keep track of authenticated sessions.

I hope this helps,
Daniel.