Secure XML querying based on authorization graphs