setup.py: try to make safe_develop safer

This splits the installation process into two pieces, to install cffi
before pynacl, since pynacl has a setup_requires=[cffi] which would
bypass peep's hash-checking. I'm not sure it's working, though, since I
still see pycparser being installed (as an egg) during the download
phase.