locking version of requests-oauthlib to 0.4.0

requests version 1.2.3 does not appear to be compatible with the
new version of requests-oauthlib.

requests-oathlib tries to import to_native_string in util.py:

```
File
"/root/.virtualenvs/edx-platform/local/lib/python2.7/site-packages/requests_oauthlib/oauth1_auth.py",
line 10, in <module>
    from requests.utils import to_native_string
ImportError: cannot import name to_native_string
```

(cherry picked from commit c54b8db6a7863ab6b0fea42c374338a8b3dd5d0a)
Merge pull request #64 from Stanford-Online/stv/pin-request-oauthlib

Lock version of requests-oauthlib to 0.4.0