[1.4.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

      This is a security fix. Disclosure and advisory coming shortly.