DDoS challenge on a XML API