BACKWARDS-INCOMPATIBLE: Format Hardening Release

Format Hardening Security Release

* XML decoding has been wrapped in the defusedxml library
* XML requests may no longer include DTDs by default
* Deserialization will return HTTP 400 for any XML decode errors
* Add `TASTYPIE_DEFAULT_FORMATS` setting to globally restrict the set of
  supported formats (closes #833)
* Content negotiation will return an error for malformed accept headers (closes #832)
* The Api class itself now allows a custom serializer (closes #817)
* The serialization documentation has been upgraded with security advice

Backwards-incompatible changes:

* XML serialization:
    - defusedxml is now required
    - defusedxml requires lxml 3 or later

    ``pip install defusedxml "lxml>=3"``
* Python 2.5 is no longer officially supported because defusedxml requires
  Python 2.6 or later.
fixed authorization if auth function returns False

* added mock to allow easier overwritting of auth
  functions
* tested when authorization *_detail function returns
  False - tests were failing. i.e. request was
  authorized, when it shouldn't have been
* updated code to raise an Unauthorized if *_detail
  functions return False
Added versiontools support!
Added in rose for simpler versioning.
Bumped to v0.9.13!