fix xml user information disclosure - reported by Joshua Heiks