Impacted versions: 8-11

## Current behavior:

If during an XMLRPC call you try to get anything from `http.request`, you'd get a `RuntimeError` such as this one:

```
Traceback (most recent call last):
  File "/opt/odoo/custom/src/odoo/odoo/service/wsgi_server.py", line 56, in xmlrpc_return
    result = odoo.http.dispatch_rpc(service, method, params)
  File "/opt/odoo/custom/src/odoo/odoo/http.py", line 118, in dispatch_rpc
    result = dispatch(method, params)
  File "/opt/odoo/custom/src/odoo/odoo/service/common.py", line 57, in dispatch
    return g[exp_method_name](*params)
  [...]
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 343, in __getattr__
    return getattr(self._get_current_object(), name)
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 302, in _get_current_object
    return self.__local()
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 135, in _lookup
    raise RuntimeError(\'object unbound\')
RuntimeError: object unbound
```

This renders imposible in practice to fix issues such as https://github.com/OCA/server-tools/issues/1125 or to implement https://github.com/odoo/odoo/pull/22212#issuecomment-380425764.

## Expected behavior:

XML-RPC calls should have request, since after all they belong to one. Otherwise, at least there should be an alternate way to access the request parameters.

Fix for v12: https://github.com/odoo/odoo/pull/24187

@Tecnativa
if request.httprequest.method == 'OPTIONS' and request.endpoint and request.endpoint.routing.get('cors'):
            headers = {
                'Access-Control-Max-Age': 60 * 60 * 24,
                'Access-Control-Allow-Headers': 'Origin, X-Requested-With, Content-Type, Accept, X-Debug-Mode'
            }
            return Response(status=200, headers=headers)
        if request.httprequest.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE') \
                and request.endpoint.routing.get('csrf', True): 
            token = self.params.pop('csrf_token', None)
            if not self.validate_csrf(token):
                if token is not None:
                    _logger.warn("CSRF validation failed on path '%s'",
                                 request.httprequest.path)
                else:
                    _logger.warn("""No CSRF validation token provided for path '%s'
Odoo URLs are CSRF-protected by default (when accessed with unsafe
HTTP methods). See
https://www.odoo.com/documentation/11.0/reference/http.html#csrf for
more details.
* if this endpoint is accessed through Odoo via py-QWeb form, embed a CSRF
  token in the form, Tokens are available via `request.csrf_token()`
  can be provided through a hidden input and must be POST-ed named
  `csrf_token` e.g. in your form add:
      <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
* if the form is generated or posted in javascript, the token value is