Fixes #926, #976, #926 and others.
defusedxml is now a requirement if you wish to support xml requests.
Merge pull request #994 from georgedorn/defusedxml_docs

Fixes #926, #976, #926 and others.