I'd say your web daemon user (probably "nobody", or "www") is not allowed to execute `ncpmount`. And the same user is probably also not allowed to jiggle around in /root/ (and there's nothing wrong with that ;).

You've got to really ask yourself wheter you want to mount something through a webinterface, for it's not very secure.