locking version of requests-oauthlib to 0.4.0

requests version 1.2.3 does not appear to be compatible with the
new version of requests-oauthlib.

requests-oathlib tries to import to_native_string in util.py:

```
File
"/root/.virtualenvs/edx-platform/local/lib/python2.7/site-packages/requests_oauthlib/oauth1_auth.py",
line 10, in <module>
    from requests.utils import to_native_string
ImportError: cannot import name to_native_string
```
Merge pull request #4023 from edx/jarv/downgrade-requests-oauthlib

locking version of requests-oauthlib to 0.4.0