Cleaned secure transport detection and fixed one missing case

Using is_secure_transport from oauthlib do the checks for https being required, with DEBUG in env skipping the check. is_secure_transport is in its own file as in oauthlib it is an internal function. There was one case where DEBUG wasn't checked yet in requests-oauthlib, this addresses this too.