Disable XML parameter parsing

* CVE-2013-0156
* https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
* http://news.ycombinator.com/item?id=5028218