xml signature attack