Lots of fixes

* use curl if it's available (fixes #9)
* for sha-based tarballs, add comment with which tag/branch it is
  (fixes #8)
* tell you where the requirements.txt file is located at the end
  (fixes #7)