As you guessed, the best and most secure way is to use a client-server organization, with a program on the server side receiving data from the applet (or application) and storing it in a database; or a simple flat file, but that's less secure against concurrent access if you think you can have many simultaneous users. With a database, the concurrency issue should be handled automatically. But otherwise, a simple lock file can manage the issue for a small number of users.

The server code is classically written in PHP, since that's the language always available on Web servers, even free ones.
But any language supported by the ISP is usable, of course.

XML isn't necessarily useful there. If you choose to use a database, no need to use XML. It is a good format for complex, structured data, but overly complex for simple data.

Authorization issues: it depends on the level of security you need / want. Anything else than SSL isn't secure enough against somebody with a little technical knowledge. It is easy to intercept exchanges between client and server and to simulate a client (or even to reverse engineer your). The scope of security is beyond a simple post like that (and I am not overly competent on the topic). I suppose the server must provide an id to a registered user and each exchange with the server must use this id, and a key generated on a previous message, etc.

If security isn't crucial and if you need only to avoid the most simple attempts at bypassing it (not much users, no crucial data), you can use regular HTTP, it would be simpler.

Hi PhiLho,

I am also looking into resources to help me manage user accounts (and user groups) on my server.  

Again, what kind of language can run on your server?

I haven't decided on a host yet.  I'm assuming it will run Java at this point.