Blacklist ObjectInputStream to close serialization hole.
Blacklist Class/forName