patched against xml sec hole