set correct content type on xml requests

fixes #1514 and #1516
TBH, I don't understand the full history of this bug very well.  
Seems like the sort of thing that someone could easily leave out by mistake (specifying the header, that is).  
I guess the question then is - will they notice easily or is it likely to get out in to the wild?