[dist] make use of the bugfixed xmlhash

1.3.5 is not thread safe