Use yaml.safe_load

see also: CVE-2013-0156