Add comment on why this yaml.load ref is safe