Note that Sandstorm also offers "passwordless email" login, which is kinda like doing a password reset for each login. The primary reason for this is that the Sandstorm team doesn't feel a normal username and password setup is adequate security with the level of protection identity providers like Google and GitHub currently offer, and because they also want to make sure the same account can be used across any Sandstorm server for eventual federation purposes. I kind of wish you could use a more insecure login method if you wanted to, as well, but that's the reasoning for it at least.
If you don't use Sandcats, which provides free dynamic DNS and wildcard SSL, Sandstorm is a bit more work to set up, but that is because it is almost certainly more secure. Sandstorm is designed to protect you from malicious or buggy apps, which require a lot of mitigation strategies that Cloudron doesn't look to offer. Some of these are why Sandstorm currently can't work with Let's Encrypt, for instance.
But Cloudron definitely has friendlier URLs, which seems to be a particularly strong desire for some people. A little DNS management could handle that for Sandstorm where desired, but they don't have that figured out yet.
Probably the biggest difference between the two is that Sandstorm doesn't put "apps" at the top level of organization, but puts "grains" (basically, files or instances) as the top organizational structure. This means individual documents run entirely separate instances of applications, which makes them more secure. It's difficult to provide say, etherpad.mysandstorm.com because each Etherpad document you have open is a completely separate Etherpad server!