Verify XML in current user's context (from token)