CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
CVE-2012-5664 options hashes should only be extracted if there are extra parameters