* using defusexml ElementTree for safer parsing of untrusted XML data * move from core dependency to platform specific dependency * style difference: put back end of list comma in setup.py