dont use @xml:base if it starts file:, dont trust it