Testing for XXE – where to find it and how to verify it