Roundcube is probably the prettiest option, but I'm curious about their security record. I definitely see http scanners looking for specific versions of it very often.