prevent XXE attacks