I have been trying to write my first big web app (more than one cgi file) and as I kept moving forward with the rough prototype, paralelly trying to predict more tasks, this is the todo that got accumulated (In no particular order).

* Validations and input sanitizations
* Object versioning (to avoid edit conflicts. I dont want hard locks)
* Exception handling
* memcache
* xss and injection protections
    * javascript
    * html
* ACLs
* phonetics in search, match and find duplicates (for form validation)
* Ajaxify!!!

(I have snipped off the project specific items.)

I know that each todo will be quite tied up to its project and technologies used. What I am wondering though, is if there is a pattern in your todo items as well as the sequence in which you experienced guys have come across them.