How does the XmlSerializer work? What ACL permissions does a process using it require?