disable xml support (https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/61bkgvnSGTQ)