Use defusedxml for sax.parse().

Use defusedxml for sax.parse(). #389