Fixes #926, #976, #926 and others.

defusedxml is now a requirement if you wish to support xml requests.