CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.

Signed-off-by: Robert Gravina <robertg@reallyenglish.com>