move XML SAX parser here

This was previously part of the backend, but it's going to be used by the
client, too.