disallow urllib3 versions that cause BadAuth [#24]