XML cleanup
defusedxml for security fix.

As per:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
Add forbid_dtd flag, since we don't need any DTDs.
Merge with master
Merge pull request #673 from tomchristie/defusedxml

XML Security fixes