Expliclty disabling loading of external XML entities when using the xml() method a response. Closes #418.