Updated deserialize function to use method parameter first

Previous patch was not using the method parameter in the deserialize function and instead attempting to depickle first, then if that failed fallback to json.  This means the security issue was not fixed, as pickle was still being called.