Improved XMLInputFactoryUtils.newSafeInstance 

javax.xml.stream.isReplacingEntityReferences doesn't prevent entity
replacement within attributes