Less-privileged code (e.g. EJB components running in a J2EE container)
that does not have file read permissions cannot load a non-default
parser factory.
E.g. the Xerces2 implementations of SAXParserFactory and DocumentBuilderFactory are not loaded even when the JRE_HOME/lib/jaxp.properties file contains
the correct factory classnames as specified in the JAXP1.1 spec.

This means that EJB components cannot use the Xerces2 parser.

To reproduce:
1. Write an EJB class which gets a SAXParserFactory instance and prints its
   classname.
2. In JRE_HOME/lib/jaxp.properties add a line
  javax.xml.parsers.SAXParserFactory=org.apache.xerces.jaxp.SAXParserFactoryImpl
3. Deploy the EJB and run it: the SAXParserFactory implementation printed is
   org.apache.crimson.jaxp.SAXParserFactoryImpl"