A few questions:
1. Your widget will be run directly from the USB stick (that is: plug in the stick, boot Chumby, and the Chumby directly loads your widget -- the regular control panel doesn't get involved) correct? Is it actually a flash widget that will be launched from the flashplayerlite? Otherwise I'm not sure your widget will be able to run at this point in time because the Chumby network is just a "stub" right now that only shows the Star Trek clock.
2. By "personal access" and "access codes", you basically mean the usernames and passwords used to access the database, right? Each user will have their own login and password for the database, and you want to be able to just use customized XML files to provide the credentials instead of hard-coding that in and recompiling the widget for each user?
If the answer to both of those are "yes", then I think your idea will work (Duane can provide a more authoritative answer though). Also, I might suggest adding the database hostname/IP address to the XML file so if, for some reason, the DB moves to a different server at some point, you just have to give people updated XML files (or have them update it themselves) rather than having to recompile and redistribute the widget.