disable external XML entities and libxml errors

thanks to Kousuke Ebihara for the report and patch.