Use ZendXML

- Uses ZendXML instead of disabling the entity loader
- Fixes some more potential XXE issues

@butonic Please test properly. Not sure whether this works 100%.