I'm fairly certain it's Ro Koo.
The transaction can't fail; users have to have a valid payment method on file. Once a user has installed the channel, their payment method has been charged and your 70% has been credited to your account (you get the money once a month). You can be fairly certain that if something is accessing your XML it's a valid Roku user, although it wouldn't be too difficult to capture packets to see what's going on between the box and your server. If you're worried about someone sniffing out what's going on, you'll have to use SSL or some other method of securing the communications. Of course, only a paying customer could capture packets anyway.
Edit: I think you messed up the vanity code. https://owner.roku.com/add/myprayer doesn't work.
It is a public channel...don't know if that makes a difference.