Depend on certifi

Resolves #2123.

This represents one possible approach to certifi: always take it if it's present. This is probably not the most secure approach, however. If we wanted to be more intelligent we could embed the version number of certifi that requests contains and use the most up-to-date version. If you're interested in doing that let me know and I'll add it as an enhancement.

Note also that this adds certifi as a hard dependency. I'd be equally happy to not install it in the install process but take it if it's there.