CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. [Refs #42502091]