Removing the VeriSign Class 3 Public Primary Certification Authority
certificate since as of December 1, 2015, Symantec has decided that this
root will no longer comply with the CAB baseline requirements.
For more information, see:
https://googleonlinesecurity.blogspot.com/2015/12/proactive-measures-in-digital.html

For socket errors besides Connection Refused, the code will swallow the
error and fall through to a misleading "ResponseNotReady" exception. This
is both incorrect and unhelpful. The code also does not retry on errors that
are potentially transient, ie, Network Unreachable or Address Not Available.

This patch addresses both concerns by raising the socket error so
that application code can handle it appropriately, or retrying if
the socket error is transient.

This likely resolves Issue #284 .

There is a problem with headers when a binary string is passed (like b'Authorization')
I've added a function to decode such strings.
It is not an elegant solution, but it works for me

- Resolve an issue where proxy information by default was not resolving DNS
  through a proxy server (unlike the `socks` library), so users getting
  proxy information from an environment variable (HTTP_PROXY/HTTPS_PROXY)
  with no external DNS could not connect to hosts with DNS names.

- Resolve a potential issue where if the proxy server was a different
  address family to the destination host and there was functional DNS, may
  not work.  For example, using a IPv4-only proxy server to connect to an
  IPv6-only host via an IPv4-only internal network.

- Improved documentation of the ProxyInfo class.

Turns out nginx doesn't support etags on gzip'd content.

Fixes issue #252.
Reviewed in https://codereview.appspot.com/7987046/.