Fixes billion laughs issue

While doing content type detection when the content type header isn't there, use JSON parsing instead of XML parsing because `xml.dom.minidom.parseString()` is vulnerable to the [billion laughs](http://en.wikipedia.org/wiki/Billion_laughs) denial of service attack.

Fixes #20.