The first attempt to upgrade xalan was rolled-back due to issues with xml security.
http://jira.jboss.com/jira/browse/JBAS-2155
Should we try the upgrade again with 4.0.4RC1?
We should try to update, but we should not be using the xalan jar that includes the xsltc dependencies.