Lock version of requests-oauthlib to 0.4.0

(cherry picked from commit c54b8db6a7863ab6b0fea42c374338a8b3dd5d0a)

@jrbl