UNDERTOW-211 allow any extension by default and move .xml off DISALLOWED list

st