JAXP 1.5: another external reference permissions added