fix sfascan (don't pass timeout to xmlrpcprotocol) and review