your original "challenge" was not to get the xml, rather, to make a useful pano. don't move the goalposts, dude! this is what you said:
"Here you have a project that has been encrypted, and you are more than
welcome to take the images from the browser cache and do with them as you
like... or in some other magical way turn this into a usable panorama on
your end: http://goo.gl/Q9wyB
I guess if someone stole your pano, you would not care if they did it via screenshots? Or you only go after them if they steal it "the right way" by stealing the xml? :)
Anyway, i'm asking "what is your end game" not regarding this security, but more in response to Sacha's comment. Seems like your tool would be much better - and sell a lot more - if it was based on krpano.
your pano is still on 360cities, it will earn enough ad revenue to buy you a beer when you come to prague. unless you want me to remove it?