add security-related note about xml parsing knobs
pass encoding to XMLParser as well.