now uses xml_security gem, tests pass locally