... 3.2 XML and security