A Flexible Framework for Architecting XML Access Control Enforcement Mechanisms