I'm assuming that they already know how to program? Perhaps they could start with a simple user login/registration application. One of the requirements must be

I'm assuming that they already know how to program? Perhaps they could start with a simple user login/registration application. One of the requirements must be to use password hashing+salt for security. I think this is an essential lesson that all should learn. Too many web applications store passwords in plain text.