BZ1150634: switch off external-parameter-entity processing in XML parser
BZ-1155314 - CVE-2012-6153 CVE-2014-3577 migrating from commons-httpclient to httpclient 4.x (cherry picked from commit 5ebd737d83d9b47fd8fe24c0f148a8a08c97827a)