Restrict attributes in to_xml

Hey Ben