Add entities validation to XML processing code for JSON entrypoints (#664 follow up)

[lindsay-stevens]

PR follow up per this comment. No sure it's worth it because it's unclear as to who uses that API and how they use it etc. So researching that would be part of this ticket.