Impacted versions: 8-11

## Current behavior:

If during an XMLRPC call you try to get anything from `http.request`, you'd get a `RuntimeError` such as this one:

```
Traceback (most recent call last):
  File "/opt/odoo/custom/src/odoo/odoo/service/wsgi_server.py", line 56, in xmlrpc_return
    result = odoo.http.dispatch_rpc(service, method, params)
  File "/opt/odoo/custom/src/odoo/odoo/http.py", line 118, in dispatch_rpc
    result = dispatch(method, params)
  File "/opt/odoo/custom/src/odoo/odoo/service/common.py", line 57, in dispatch
    return g[exp_method_name](*params)
  [...]
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 343, in __getattr__
    return getattr(self._get_current_object(), name)
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 302, in _get_current_object
    return self.__local()
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 135, in _lookup
    raise RuntimeError(\'object unbound\')
RuntimeError: object unbound
```

This renders imposible in practice to fix issues such as https://github.com/OCA/server-tools/issues/1125 or to implement https://github.com/odoo/odoo/pull/22212#issuecomment-380425764.

## Expected behavior:

XML-RPC calls should have request, since after all they belong to one. Otherwise, at least there should be an alternate way to access the request parameters.

Fix for v12: https://github.com/odoo/odoo/pull/24187

@Tecnativa
Odoo implements token-based `CSRF protection
        <https://en.wikipedia.org/wiki/CSRF>`_.
        CSRF protection is enabled by default and applies to *UNSAFE*
        HTTP methods as defined by :rfc:`7231` (all methods other than
        ``GET``, ``HEAD``, ``TRACE`` and ``OPTIONS``).
        CSRF protection is implemented by checking requests using
        unsafe methods for a value called ``csrf_token`` as part of
        the request's form data. That value is removed from the form
        as part of the validation and does not have to be taken in
        account by your own form processing.
        When adding a new controller for an unsafe method (mostly POST
        for e.g. forms):
        * if the form is generated in Python, a csrf token is
          available via :meth:`request.csrf_token()
          <odoo.http.WebRequest.csrf_token`, the
          :data:`~odoo.http.request` object is available by default
          in QWeb (python) templates, it may have to be added
          explicitly if you are not using QWeb.
        * if the form is generated in Javascript, the CSRF token is
          added by default to the QWeb (js) rendering context as
          ``csrf_token`` and is otherwise available as ``csrf_token``
          on the ``web.core`` module:
          .. code-block:: javascript
              require('web.core').csrf_token
        * if the endpoint can be called by external parties (not from
          Odoo) as e.g. it is a REST API or a `webhook
          <https://en.wikipedia.org/wiki/Webhook>`_, CSRF protection
          must be disabled on the endpoint. If possible, you may want
          to implement other methods of request validation (to ensure
          it is not called by an unrelated third-party).