The way I did it with my script, is that each person is given a random passkey each time they sign in to their account. This passkey is needed each time info is sent to the server. The user does not need to know what this key is, as it happens behind the scenes. I do not use XML at all, instead everything is stored in a MySQL database on the server.
Full
source code available if you want some insight.