I have cobbled together several ancient PCs to run as kiosks via a limited user login using XFCE on Ubuntu Linux (12.04) and am about to trial the same method using Debian Wheezy (currently Wheezy is beta) using its XFCE iso and I am planning to try the same thing with Raspbian with an XFCE desktop... BUT if you power users tell me XFCE plus Raspbian Wheezy is going to overwhelm the device, I won't go down that road. Especially since it would be Linux plus XFCE plus either Firefox or Chromium (this combo can be extremely locked down on a workstation).
The objective is a more-or-less unattended station on a plain vanilla network and the station is highly restricted in what it can do and hard for teenagers to hack. XFCE makes heavy use of XML that can be edited without a lot of pain. I've put a HOWTO under my user name charles-2007 on the XFCE forum for XFCE 4.8. I'm going to update this with Chrome/Chromium soon as it is way easier.
If this works -- all I've got to worry about is the teenagers walking off with the RPi !