I thought this was a pretty cool example of what you can do with Ajax + Exchange + Active Directory. I am no web developer, so expect to find design bugs, and even bugs in the implementation of my own api : ) The security has been heavily scrutinized, however, and you're fine there. It's all open source code anyway, so look for yourself : )
The demo user name and password are 'owa.app'
Be aware that you will have to make certain security allowances. The page explains how to do it and why.
Maybe the Zimbra developers can use some of tihs to make their app integrate on the fly with Exchange...