defusing xml before inserting attrs