security fix (2) for CVE-2013-0156: disable xml params parser.