disable XML params, they are just used by malicious bots to determine if we have XML vuls.