Default to disallowing external and insecurely hosted files
Fix tests with the new defaults
Merge pull request #1055 from pypa/default-externals-to-off

Default to disallowing external and insecurely hosted files