fixed xml location, added api key instead of user and pass auth