Add LOCALSHOP_PYPI_URL instead of hardcoded value

Also use https:// by default now
Validate the md5 hash of the mirrored releases

This should fix #28