Use the system CA bundle if available

This feels like a bit of a layering violation. It doesn't *really* belong in demands, but doesn't belong anywhere else any more than here. And here is probably the most convenient.

The issue is: On integration environments, the SSL certificate is signed by our own CA. This isn't in the SSL bundle included with requests. My plan in the past was to have a custom [certifi](https://github.com/kennethreitz/certifi) package in YolaPI, with our CA included. However, upstream requests [has given up on certifi](https://github.com/kennethreitz/requests/pull/1110), and gone back to a bundle. And maintaining our own for of requests just to add a CA, sounds like a waste of time.

We could also monkey-patch `requests.utils.DEFAULT_CA_BUNDLE_PATH` or `requests.certs.where`, but I prefer not having requests magically change behaviour just because something is imported...

So, any better ideas?