add security-related note about xml parsing knobs