xxe and HttpExecutionContext.prepare backport to 2.2.x

Backports for #3480 and #3342 to 2.2.x.