Fixed a security issue by disallowing binding expressions to include any properties that are assignable to certain sensitive types (Class, ClassLoader, ActionBeanContext, ServletRequest, ServletResponse, HttpSession).