server certificate validation

introduces requirement on backports.ssl_match_hostname where applicatble (<=Python3.2 or so).
pyp and/or requirements file will have to be updated too.
includes additional file to maintain -- a certificate bundle, ripped from python-requests, originally from mozilla/firefox.
please let me know if I missed something, could do anything better, or whatever is needed for patch to be accepted.