XML Entity expansion protection