This is a potentially far-reaching subject because any combination of contracts, clients and servers is possible, each with their own implementation details.
I can provide an introductory conceptual starting point for your thinking using the Minimum Viable Token contract here: https://www.ethereum.org/token
The Smart Contract is designed to track balances for users. In summary, it's a bank. Important thing to realize is
msg.sender is always the ethereum address that called the function. This is the user's Ethereum address.
mapping (address => uint256) public balanceOf;
sets up a namespace using addresses as keys and storing unsigned integers called
public means there is a read-only getter function that will require one argument (the
address) and return a
uint256. Anyone can use that to inquire about anyone's balance.
There's also a function
Notice that it uses
msg.sender to find values stored in
balanceOf. In particular, this line is illustrative:
balanceOf[msg.sender] -= _value;
The balance of the
msg.sender is reduced by the
_value to transfer.
Implicitly, users can only send from their own accounts. A browser-based user interface could tell the user's Ethereum node to send a transaction to the contract. The contract would check for sufficient funds, then move the funds (
_value) from the user to the
_to address (passed in). The end.
A web server isn't needed in the simple case above. In many cases, a web server may be interested. Ethereum has a facility to inform a web server. An event emitter can be added to the contract. A server can have its own Ethereum node and listen for important events.
Hope it helps.