The server needs to be installed on Windows XP and has to host an ASP .NET 2.0 + ASP .NET AJAX 1.0 based web application.
What is the simultaneous connection limit? (as opposed to 40 in IIS on XP)
Are there any other limitations/short-comings that I need to be aware of?
There are several problems with Cassini, most common listed problems are a limit on the maximum concurrent connections and a lack of SSL support. There are also security problems stemming from how Cassini runs in a priveleged account so if an application served by Cassini is compromised, the attacker gains control of the entire system.
If you need to host an intranet application, these issues probably aren't a big deal. However, another feature lacking in Cassini is logging which I think is important even for intranet applications. This devx article discusses how to implement your own logging by extending the Cassini source code yourself, but doing so introduces other problems if it's not done "properly".
Comet Way, the company I work for, makes a product called the Neokernel Web Server that is a secure, professional, ASP.NET enabled web server designed for embedding in .NET applications. Like Cassini, the Neokernel runs any ASP.NET web application that works under IIS, and it addresses the above problems. It has features for handling other issues with embedding a web server in your application, for instance starting/stopping the server programmatically and APIs for extending the server with your own request processing code. It is not based on the Cassini source code. Maximum concurrent connections (and a variety of other parameters) can be specified via XML configuration files. The Neokernel Web Server is a commercial product, but a free evaluation license is available.