added parameter to disable the loading of external entities in XML response bodies

This is really just a convenience parameter to make it easier for people to stay secure.

See http://websec.io/2012/08/27/Preventing-XXE-in-PHP.html for more information.