XML: How to require either or both of two child elements, but prevent both missing?