Prevent XML bombs - enable secure parsing and disallow doctype declarations
Merge branch 'prevent-xml-bomb' into 1.3.x-codeborne