don't crash on invalid icon mime-type in device desc xml
recover device xml with garbage preceding the xml
don't crash when sending remote action with invalid control url
do not send mac header in outgoing notification
do not send mac header in outgoing search response
set Content-Type header in outgoing event response
Device without identity fails validation (NPE later otherwise)
validate device identity (valid UDN)
validate state variables before actions
remove actions that do not validate instead of just failing
various hardening of data types
only XML encode ' and " in attributes
fixed wrong response type to root devices search requests
remove garbage chars workaround in callback URL, fixed elsewhere
fix bogus incoming URL path in http request 
fix omitted Content-Type in some http responses
fixed bad Content-Type in response of some requests
fix NPE in constructor