Don't allow external entities
Add tests for libxml and expat parser.
Expat was behaving correctly, but LibXML wasn't
I'm going to merge this, but I'm going to follow it up with undoing the change to t/41_server_hang.t. This test is needed, as it checks for a specific bug.
oops, it wasn't my intention to skip that test for everyone, just me :)