update multi_xml version to most recent one

Previous versions of multi_xml were unsafe just like Rails.

see: https://github.com/sferik/multi_xml/pull/34