add code injection filter doesn't protect against "Expression Language Injection", therefore I've added an schema compiler option to activate the copying of the annotation which is by default off