cgi-server: Implement opt-out from statistics and only count once
cgi-server: Bail out on requests with broken XML

And add tests for that!