Use defusedxml, related to issue #295