ease dependency on a specific version of urllib3

as a 3rd party module, we really shouldn't be so specific about what version of urllib3 we depend on.

verson 1.2 added python 3 support, so that's as low as we can go.
having a loose dependency to be below 2.0 should keep us testing against the latest urllb3 on Travis.