Allow the user to pin oauth2 and requests. Require a minimum version, not an exact one.

Also, make it work with the change deployed by Fitbit on Jan 22 2014 that does stricter checks on oauth compliance.