The XmlCardLoader now sanitizes the input when reading resources from cards, closes #133.