The word 'document' invokes too many preconceived notions to be used in this context, I believe. XML stream is more like it. XML stream that changes its structure over time requires dynamic schema with ability to redefine, augment, remove schema fragments. Implementation wise, this is rather simple. Have client dynamically download schema fragment-specific handlers.
Security is no problem since they are restricted to operations on the stream itself.
Java is a perfect fit for this. Frankly I do not how to call this. It seems that, in the last year, the tendency to use HTTP as a transport mechanism and URLs as function call mechanism has gained some adepts. An important trait of this latest spec is the usage of URLs as function calls and XML as the result of these function calls. We have here a classical request and response function.