This question was asked on Reddit:
Is there a secure/recommended solution to unlock an account and send a tx through the Web3 interface (from a Html page)?
One of the alternatives that I have in mind is just to disable the Rpc and create a layer, and expose custom methods through it.