set options: writeBaseUri=0, loadExternalEntities=0