Backport changes from ssl.match_hostname in Python 3.3.

Includes two commits:
* Fix potential CPU DoS via abusive wildcard pattern
  http://hg.python.org/cpython/rev/fafd33db6ff6
* Fall back to common name when SAN doesn't contain any DNS names
  http://hg.python.org/cpython/rev/1b37827984ba

Closes #799.