added a word of caution about input docs

about potential issues with untrusted XML and XSL files