update vote.to_xml to handle serialized tracking

security fix disallowed parsing of YAML in XML