Add xml to the list of allowed uploads types

I can't see any reason we wouldn't allow this. And it was raised in
zendesk ticket that one department really wants to use it.