</mime-type>

  <!-- Note - password protected OOXML files are actually stored in -->
  <!--  an OLE2 (application/x-tika-msoffice) container. -->
  <!--  The are logically subclasses of (application/x-tika-ooxml),
        but their containers are literally subclasses
        of (application/x-tika-msoffice) -->
  <mime-type type="application/x-tika-ooxml-protected">
    <sub-class-of type="application/x-tika-msoffice"/>

avoids/fixes a potential security issue: as the returned object is passed directly to Pydantic, if the returned object was a subclass of the `response_model` (e.g. you return a `UserInDB` that inherits from `User` but contains extra fields, like `hashed_password`, and `User` is used in the `response_model`), it would still pass the validation (because `UserInDB` is a subclass of `User`) and the object would be returned as-is, including the `hashed_password`. To fix this, the declared `response_model`...