Why not use suexec and install a copy webdav script in each user's cgi area?....

If someone finds a flaw in your script, they can ownz0r all your users, but not have root :)