Disable resolve_entities by default with one billion laughs entity expansion problems. http://en.wikipedia.org/wiki/Billion_laughs

Facebook recently issued its largest bug bounty to remove this security bug.

https://www.facebook.com/BugBounty/posts/778897822124446?stream_ref=10

This may result in breaking changes but should be considered an important
security enhancement.

Test fix included.