Why XML Security is Broken