Text messaging application - AES with or without message authentication I want my application to have confidentiality and integrity.

Let's say I have managed to securely share an AES key between two parties in my messaging application.

The applications communicate by sending XML messages. The XML has two tags, one for the actual text message and one for the timestamp the message was sent. This is in order make sure a replay attack cannot take place. 

The XML message is encrypted with the AES algorithm and then it is sent to the recipient.

Should in this scenario add message authentication? Since the key is only known by the two parties, it should be enough to provide both confidentiality and integrity.

The worst case scenario I can think of, is someone sending a random stream of characters which will be decrypted successfully in a well formed XML message with a correct timestamp, since in any other case the message will be ignored by the receiver.
Non-authenticated symmetric encryption is malleable, meaning that an attacker who intercepts an encrypted message can modify it in ways that result in (at least partially) predictable changes to the decrypted plaintext even if they do not know the encryption key.

The exact ways in which this can be done depend on the mode of operation used, but the most obvious examples are streaming modes like CTR and OFB, where simply flipping any bit of the ciphertext will flip the corresponding bit of the plaintext.  Thus, an attacker who could guess a part of your encrypted XML message could manipulate it in nearly any way they like by replacing characters with different ones &mdash; replacing authorized user IDs with a different ID, changing ="false" to ="true" , altering the XML markup itself, etc.

Other non-authenticated encryption modes like CBC are malleable in less obvious ways, such that modifying the ciphertext will, as a side effect, typically garble at least some of the nearby plaintext in unpredictable ways.  However, it may still be possible to modify messages encrypted using these modes, if the attacker can arrange their modifications so that the garbled parts of the resulting plaintext will be ignored by the recipient (e.g. by wrapping them in an XML comment).

The point of all this is that, if you want your encryption to be secure against active attacks (i.e. attacks that may involve the attacker constructing their own messages, possibly by modifying intercepted ones), then you need some form of message integrity protection.  This can be achieved by applying a MAC on top of a traditional non-authenticated encryption mode, or by using an authenticated encryption mode that handles both confidentiality and integrity protection.  You could even achieve it e.g. by digitally signing all your messages with some public-key signature scheme.  But if you allow an attacker to actively send forged messages and don't have some way to detect it, they can do a lot more than just "sending a random stream of characters".