Fixing installing packages that don't use setuptools

This patch just applies the solution found in `pip` to force using
`setuptools` even when the packager decided to use things like
distutils.
Better message when we cant find a package in the downloader
Authentication is working again for pypi repos
Fixing listing nested requirement files in expand_requirements()
Making sure the package name sent to locators is safe (s/-/_/g)
Using `distlib.database.DistributionPath` instead of pkg_resources to implement check_install
Distlib requires us to convert requirement specs to the new standard
Using the parse_requirement(r).requirements attr in util.safe_name()
Normalizing the pkg name before passing to DistributionPath.get_distribution
Removing comments after pkg names out of requirements files
Fixing wrong usage of possibly None attr in obj returned by parse_requirement
Allowing prereleases to be located by default in the downloader
Adding the /api endpoint to provide data to the download.CurdlingLocator()