Added Element module for type-safe XML handling

Also, fixed Tree: since we only visit each role once, follow all the
commands. Before, we only looked at commands required by the first user.