locking down requests version