Disable resolve_entities by default for security reasons.

Facebook recently issued its largest bug bounty to remove this security bug.

https://www.facebook.com/BugBounty/posts/778897822124446?stream_ref=10

This may result in breaking changes but should be considered an important
security enhancement.

Test fix included.