fixes #1 Security issue in yaml.load()