saner flags for virtualenv

Don't use ``--upgrade`` when updating, so it doesn't re-download everything on each deploy (``--upgrade`` makes it hit the net and re-download everything even if it's pinned and installed).

Don't use ``--system-site-packages`` to properly have properly isolated environments.