I hadn't checked properly, but I believe you are right XML doesn't accept control characters. Removing them by default, whilst also giving the option to request them, sounds like a good solution to me.