Switch to yaml.safe_load.

This is to prevent running arbitrary python code from unknown sources.