I do have a question though: XML is fine for a web game, but what if I wanted to package this game (or future games) and distribute it as a PC/Mac application? I don't want the XML to be accessible by the end user, since they could just edit those files to do whatever they please.
I personally don't see an issue if the user edits your XML. It's up to you if you are concerned about it.

One easy option is to create a hash of the XML data as a string and then hard code that hash in the SWF (a hash is quite small). When you load the XML, you hash it again and compare the hard-coded SWF hash with the newly generated hash. If they don't match, you know the user tampered with the XML. This sounds harder then it is. Probably less then 20 lines of code at the most. It also works even if the game is being run locally or from the web as it's deployment agnostic. I can provide more details if you are interested.

Also, many of the SWF to EXE wrappers provide the ability to embed data into the EXE itself and then provide an API to load that data back. I've not used it myself but I'm pretty sure Zinc does that. It's similiar to embeding resource files (like icons) into an EXE when you build it from Visual Studio - if you've done that in school or some such you will know what I mean. Have fun!