Impacted versions: 8-11

## Current behavior:

If during an XMLRPC call you try to get anything from `http.request`, you'd get a `RuntimeError` such as this one:

```
Traceback (most recent call last):
  File "/opt/odoo/custom/src/odoo/odoo/service/wsgi_server.py", line 56, in xmlrpc_return
    result = odoo.http.dispatch_rpc(service, method, params)
  File "/opt/odoo/custom/src/odoo/odoo/http.py", line 118, in dispatch_rpc
    result = dispatch(method, params)
  File "/opt/odoo/custom/src/odoo/odoo/service/common.py", line 57, in dispatch
    return g[exp_method_name](*params)
  [...]
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 343, in __getattr__
    return getattr(self._get_current_object(), name)
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 302, in _get_current_object
    return self.__local()
  File "/usr/local/lib/python2.7/dist-packages/werkzeug/local.py", line 135, in _lookup
    raise RuntimeError(\'object unbound\')
RuntimeError: object unbound
```

This renders imposible in practice to fix issues such as https://github.com/OCA/server-tools/issues/1125 or to implement https://github.com/odoo/odoo/pull/22212#issuecomment-380425764.

## Expected behavior:

XML-RPC calls should have request, since after all they belong to one. Otherwise, at least there should be an alternate way to access the request parameters.

Fix for v12: https://github.com/odoo/odoo/pull/24187

@Tecnativa
odoo/http.py
available as `csrf_token` on `web.core` and as the `csrf_token`
  value in the default js-qweb execution context
* if the form is accessed by an external third party (e.g. REST API
  endpoint, payment gateway callback) you will need to disable CSRF
  protection (and implement your own protection if necessary) by
  passing the `csrf=False` parameter to the `route` decorator.
                    """, request.httprequest.path)
                raise werkzeug.exceptions.BadRequest('Session expired (invalid CSRF token)')
        r = self._call_function(**self.params)
        if not r:
            r = Response(status=204)  
        return r
    def make_response(self, data, headers=None, cookies=None):
        """ Helper for non-HTML responses, or HTML responses with custom
        response headers or cookies.
        While handlers can just return the HTML markup of a page they want to
        send as a string if non-HTML data is returned they need to create a
        complete response object, or the returned data will not be correctly
        interpreted by the clients.
        :param basestring data: response body
        :param headers: HTTP headers to set on the response
        :type headers: ``[(name, value)]``
        :param collections.Mapping cookies: cookies to set on the client
        """
        response = Response(data, headers=headers)
        if cookies:
            for k, v in cookies.items():
                response.set_cookie(k, v)
        return response
    def render(self, template, qcontext=None, lazy=True, **kw):