I tought of some strategies, but I have no idea which can work. 1) have the authentication happen on the main site and somehow propagate it to the minisite. It will probably be possible to fake the authentication at the minisite, but at least it won't be possible to crack the PW database without cracking the main site.
2) read the PW database at the main site. But if I'm allowed to do it, I guess that's an opening
3) have the DB duplicated at my site. Hackerfest? XD