Instantiating random classes in Velocity should not be allowed

We need to fix this.

#set ($math = $context.getClass().forName("org.apache.velocity.tools.generic.MathTool").newInstance())

This should not be allowed.