Use the system CA bundle if available

This feels like a bit of a layering violation. It doesn't *really* belong in demands, but doesn't belong anywhere else any more than here. And here is probably the most convenient.

The issue is: On integration environments, the SSL certificate is signed by our own CA. This isn't in the SSL bundle included with requests. My plan in the past was to have a custom [certifi](https://github.com/kennethreitz/certifi) package in YolaPI, with our CA included. However, upstream requests [has given up on certifi](https://github.com/kennethreitz/requests/pull/1110), and gone back to a bundle.

So, any better ideas?