don't use XML CDATA to guard cc numbers