Impacted versions: 8-11

## Current behavior:

If during an XMLRPC call you try to get anything from `http.request`, you'd get a `RuntimeError` such as this one:

```
Traceback (most recent call last):
  File "/opt/odoo/custom/src/odoo/odoo/service/wsgi_server.py", line 56, in xmlrpc_return
    result = odoo.http.dispatch_rpc(service, method, params)
  File "/opt/odoo/custom/src/odoo/odoo/http.py", line 118, in dispatch_rpc
    result = dispatch(method, params)
  File "/opt/odoo/custom/src/odoo/odoo/service/common.py", line 57, in dispatch
    return g[exp_method_name](*params)
  [...]
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 343, in __getattr__
    return getattr(self._get_current_object(), name)
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 302, in _get_current_object
    return self.__local()
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 135, in _lookup
    raise RuntimeError(\'object unbound\')
RuntimeError: object unbound
```

This renders imposible in practice to fix issues such as https://github.com/OCA/server-tools/issues/1125 or to implement https://github.com/odoo/odoo/pull/22212#issuecomment-380425764.

## Expected behavior:

XML-RPC calls should have request, since after all they belong to one. Otherwise, at least there should be an alternate way to access the request parameters.

Fix for v12: https://github.com/odoo/odoo/pull/24187

@Tecnativa
"""
        The database linked to this request. Can be ``None``
        if the current request uses the ``none`` authentication.
        """
        return self.session.db if not self.disable_db else None
    def csrf_token(self, time_limit=3600):
        """ Generates and returns a CSRF token for the current session
        :param time_limit: the CSRF token should only be valid for the
                           specified duration (in second), by default 1h,
                           ``None`` for the token to be valid as long as the
                           current user's session is.
        :type time_limit: int | None
        :returns: ASCII token string
        """
        token = self.session.sid
        max_ts = '' if not time_limit else int(time.time() + time_limit)
        msg = '%s%s' % (token, max_ts)
        secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
        assert secret, "CSRF protection requires a configured database secret"
        hm = hmac.new(secret.encode('ascii'), msg.encode('utf-8'), hashlib.sha1).hexdigest()
        return '%so%s' % (hm, max_ts)
    def validate_csrf(self, csrf):