add support for loading metadata over https

currently metadata is read as a file, but it also works from url, e.g.
http://federation.belnet.be/federation-metadata.xml
because lxml's parse supports this.

However, lxml doesn't support https, 
we could work around this by opening https urls and letting lxml parse from string

make sure certs are checked in this case!
