move download functions into standalone module
add script to download tarball from PyPI
PyPI: skip download if existing file OK
use HTTPS URLs instead of HTTP

Unfortunately urllib2 does not validate certificates, so this will not
prevent MITM attacks.