I would use neither on their own for anything security related. As you suggest they would only supply the interface. I've little experience with Applets except for 3D viewers on Intranets and the like, but have used Flash for log in page graphics/data sending.

The Flash log in pages are only as secure as the script they use, i've used basic PHP login scripts with a Flash interface or the same to work on a server running Tomcat or similar. The point being Flash or your Applet will only provide the interface not the security.

You can make password/login scripts completely in Flash but they are so easy to bypass they are pointless.