That depends on the value of the assets involved ; how much user convenience you are willing to sacrifice to beef up security; how much security effort you want to put in and what is the likleyhood of bad guys desiring to break into your system.

Basically, your system is adequate to prevent access by a medium-energy, casual thief. Unless finance or very private information is involved, that is usually good enough. Besides you get much less bang (security) for the buck (additional security effort) beyond this point. The only thing I'd add is SSL/HTTPS.