updated to latest boto, which merged the XML-escaping of external URLs