use 'rb' file mode since that's what defusedxml uses