diff --git a/README.md b/README.md
index 747b98b2..3ff124d7 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,10 @@ The latest stable version [is available on PyPI](https://pypi.python.org/pypi/do
 
     pip install docker
 
+If you are intending to connect to a docker host via TLS, add `docker[tls]` to your requirements instead, or install with pip:
+
+    pip install docker[tls]
+
 ## Usage
 
 Connect to Docker using the default socket or the configuration in your environment:
diff --git a/appveyor.yml b/appveyor.yml
index 1fc67cc0..41cde625 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,7 +3,7 @@ version: '{branch}-{build}'
 install:
   - "SET PATH=C:\\Python27-x64;C:\\Python27-x64\\Scripts;%PATH%"
   - "python --version"
-  - "pip install tox==2.1.1 virtualenv==13.1.2"
+  - "pip install tox==2.7.0 virtualenv==15.1.0"
 
 # Build the binary after tests
 build: false
diff --git a/docker/api/build.py b/docker/api/build.py
index cbef4a8b..5d4e7720 100644
--- a/docker/api/build.py
+++ b/docker/api/build.py
@@ -274,7 +274,10 @@ class BuildApiMixin(object):
                         self._auth_configs, registry
                     )
             else:
-                auth_data = self._auth_configs
+                auth_data = self._auth_configs.copy()
+                # See https://github.com/docker/docker-py/issues/1683
+                if auth.INDEX_NAME in auth_data:
+                    auth_data[auth.INDEX_URL] = auth_data[auth.INDEX_NAME]
 
             log.debug(
                 'Sending auth config ({0})'.format(
diff --git a/docker/auth.py b/docker/auth.py
index ec9c45b9..c3fb062e 100644
--- a/docker/auth.py
+++ b/docker/auth.py
@@ -10,7 +10,7 @@ from . import errors
 from .constants import IS_WINDOWS_PLATFORM
 
 INDEX_NAME = 'docker.io'
-INDEX_URL = 'https://{0}/v1/'.format(INDEX_NAME)
+INDEX_URL = 'https://index.{0}/v1/'.format(INDEX_NAME)
 DOCKER_CONFIG_FILENAME = os.path.join('.docker', 'config.json')
 LEGACY_DOCKER_CONFIG_FILENAME = '.dockercfg'
 TOKEN_USERNAME = '<token>'
@@ -118,7 +118,7 @@ def _resolve_authconfig_credstore(authconfig, registry, credstore_name):
     if not registry or registry == INDEX_NAME:
         # The ecosystem is a little schizophrenic with index.docker.io VS
         # docker.io - in that case, it seems the full URL is necessary.
-        registry = 'https://index.docker.io/v1/'
+        registry = INDEX_URL
     log.debug("Looking for auth entry for {0}".format(repr(registry)))
     store = dockerpycreds.Store(credstore_name)
     try:
diff --git a/docker/utils/build.py b/docker/utils/build.py
index 79b72495..d4223e74 100644
--- a/docker/utils/build.py
+++ b/docker/utils/build.py
@@ -26,6 +26,7 @@ def exclude_paths(root, patterns, dockerfile=None):
     if dockerfile is None:
         dockerfile = 'Dockerfile'
 
+    patterns = [p.lstrip('/') for p in patterns]
     exceptions = [p for p in patterns if p.startswith('!')]
 
     include_patterns = [p[1:] for p in exceptions]
diff --git a/requirements.txt b/requirements.txt
index 37541312..f3c61e79 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,16 @@
-requests==2.11.1
-six>=1.4.0
-websocket-client==0.32.0
-backports.ssl_match_hostname>=3.5 ; python_version < '3.5'
-ipaddress==1.0.16 ; python_version < '3.3'
+appdirs==1.4.3
+asn1crypto==0.22.0
+backports.ssl-match-hostname==3.5.0.1
+cffi==1.10.0
+cryptography==1.9
 docker-pycreds==0.2.1
+enum34==1.1.6
+idna==2.5
+ipaddress==1.0.18
+packaging==16.8
+pycparser==2.17
+pyOpenSSL==17.0.0
+pyparsing==2.2.0
+requests==2.14.2
+six==1.10.0
+websocket-client==0.40.0
diff --git a/setup.py b/setup.py
index 31180d23..4a33c8df 100644
--- a/setup.py
+++ b/setup.py
@@ -35,6 +35,16 @@ extras_require = {
     # ssl_match_hostname to verify hosts match with certificates via
     # ServerAltname: https://pypi.python.org/pypi/backports.ssl_match_hostname
     ':python_version < "3.3"': 'ipaddress >= 1.0.16',
+
+    # If using docker-py over TLS, highly recommend this option is
+    # pip-installed or pinned.
+
+    # TODO: if pip installing both "requests" and "requests[security]", the
+    # extra package from the "security" option are not installed (see
+    # https://github.com/pypa/pip/issues/4391).  Once that's fixed, instead of
+    # installing the extra dependencies, install the following instead:
+    # 'requests[security] >= 2.5.2, != 2.11.0, != 2.12.2'
+    'tls': ['pyOpenSSL>=0.14', 'cryptography>=1.3.4', 'idna>=2.0.0'],
 }
 
 version = None

diff --git a/tests/unit/utils_test.py b/tests/unit/utils_test.py
index 7045d23c..4a391fac 100644
--- a/tests/unit/utils_test.py
+++ b/tests/unit/utils_test.py
@@ -768,6 +768,11 @@ class ExcludePathsTest(unittest.TestCase):
             self.all_paths - set(['foo/a.py'])
         )
 
+    def test_single_subdir_single_filename_leading_slash(self):
+        assert self.exclude(['/foo/a.py']) == convert_paths(
+            self.all_paths - set(['foo/a.py'])
+        )
+
     def test_single_subdir_with_path_traversal(self):
         assert self.exclude(['foo/whoops/../a.py']) == convert_paths(
             self.all_paths - set(['foo/a.py'])

using private image in FROM during build is broken
Example:
```
import docker
from io import BytesIO

dockerfile="""
FROM <some-private-image-on-docker-hub>
CMD ["ls"]
"""

f = BytesIO(dockerfile.encode('utf-8'))

client = docker.APIClient(version='auto')
client.login(username='<user>', password='<pass>')

for l in client.build(fileobj=f, rm=True, tag='test', stream=True, pull=True):
  print(l)
```

This example will error saying that it failed to find the image in FROM. If you add the full registry:

```
client = docker.APIClient(version='auto')
client.login(username='<user>', password='<pass>', registry='https://index.docker.io/v1/')
```

It will succeed. If you leave off the trailing slash on the registry url, it will fail.

python 3.5.2
docker-py 2.4.2
tests/unit/utils_test.py::ExcludePathsTest::test_single_subdir_single_filename_leading_slash
tests/unit/utils_test.py::DecoratorsTest::test_update_headers tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_alternate_env tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_empty tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_no_cert_path tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_tls tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_tls_verify_false tests/unit/utils_test.py::KwargsFromEnvTest::test_kwargs_from_env_tls_verify_false_no_cert tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_compact tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_complete tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_empty tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_list tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_no_mode tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_unicode_bytes_input tests/unit/utils_test.py::ConverVolumeBindsTest::test_convert_volume_binds_unicode_unicode_input tests/unit/utils_test.py::ParseEnvFileTest::test_parse_env_file_commented_line tests/unit/utils_test.py::ParseEnvFileTest::test_parse_env_file_invalid_line tests/unit/utils_test.py::ParseEnvFileTest::test_parse_env_file_newline tests/unit/utils_test.py::ParseEnvFileTest::test_parse_env_file_proper tests/unit/utils_test.py::ParseEnvFileTest::test_parse_env_file_with_equals_character tests/unit/utils_test.py::ParseHostTest::test_parse_host tests/unit/utils_test.py::ParseHostTest::test_parse_host_empty_value tests/unit/utils_test.py::ParseHostTest::test_parse_host_tls tests/unit/utils_test.py::ParseHostTest::test_parse_host_tls_tcp_proto tests/unit/utils_test.py::ParseHostTest::test_parse_host_trailing_slash tests/unit/utils_test.py::ParseRepositoryTagTest::test_index_image_no_tag tests/unit/utils_test.py::ParseRepositoryTagTest::test_index_image_sha tests/unit/utils_test.py::ParseRepositoryTagTest::test_index_image_tag tests/unit/utils_test.py::ParseRepositoryTagTest::test_index_user_image_no_tag tests/unit/utils_test.py::ParseRepositoryTagTest::test_index_user_image_tag tests/unit/utils_test.py::ParseRepositoryTagTest::test_private_reg_image_no_tag tests/unit/utils_test.py::ParseRepositoryTagTest::test_private_reg_image_sha tests/unit/utils_test.py::ParseRepositoryTagTest::test_private_reg_image_tag tests/unit/utils_test.py::ParseDeviceTest::test_dict tests/unit/utils_test.py::ParseDeviceTest::test_full_string_definition tests/unit/utils_test.py::ParseDeviceTest::test_hybrid_list tests/unit/utils_test.py::ParseDeviceTest::test_partial_string_definition tests/unit/utils_test.py::ParseDeviceTest::test_permissionless_string_definition tests/unit/utils_test.py::ParseBytesTest::test_parse_bytes_float tests/unit/utils_test.py::ParseBytesTest::test_parse_bytes_invalid tests/unit/utils_test.py::ParseBytesTest::test_parse_bytes_maxint tests/unit/utils_test.py::ParseBytesTest::test_parse_bytes_valid tests/unit/utils_test.py::UtilsTest::test_convert_filters tests/unit/utils_test.py::UtilsTest::test_decode_json_header tests/unit/utils_test.py::SplitCommandTest::test_split_command_with_unicode tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_matching_internal_port_ranges tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_matching_internal_ports tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_nonmatching_internal_port_ranges tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_nonmatching_internal_ports tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_one_port tests/unit/utils_test.py::PortsTest::test_build_port_bindings_with_port_range tests/unit/utils_test.py::PortsTest::test_host_only_with_colon tests/unit/utils_test.py::PortsTest::test_non_matching_length_port_ranges tests/unit/utils_test.py::PortsTest::test_port_and_range_invalid tests/unit/utils_test.py::PortsTest::test_port_only_with_colon tests/unit/utils_test.py::PortsTest::test_split_port_empty_string tests/unit/utils_test.py::PortsTest::test_split_port_invalid tests/unit/utils_test.py::PortsTest::test_split_port_no_host_port tests/unit/utils_test.py::PortsTest::test_split_port_non_string tests/unit/utils_test.py::PortsTest::test_split_port_random_port_range_with_host_port tests/unit/utils_test.py::PortsTest::test_split_port_range_no_host_port tests/unit/utils_test.py::PortsTest::test_split_port_range_with_host_ip_no_port tests/unit/utils_test.py::PortsTest::test_split_port_range_with_host_port tests/unit/utils_test.py::PortsTest::test_split_port_range_with_protocol tests/unit/utils_test.py::PortsTest::test_split_port_with_host_ip tests/unit/utils_test.py::PortsTest::test_split_port_with_host_ip_no_port tests/unit/utils_test.py::PortsTest::test_split_port_with_host_port tests/unit/utils_test.py::PortsTest::test_split_port_with_ipv6_address tests/unit/utils_test.py::PortsTest::test_split_port_with_protocol tests/unit/utils_test.py::PortsTest::test_with_no_container_port tests/unit/utils_test.py::ExcludePathsTest::test_directory tests/unit/utils_test.py::ExcludePathsTest::test_directory_with_single_exception tests/unit/utils_test.py::ExcludePathsTest::test_directory_with_subdir_exception tests/unit/utils_test.py::ExcludePathsTest::test_directory_with_trailing_slash tests/unit/utils_test.py::ExcludePathsTest::test_directory_with_wildcard_exception tests/unit/utils_test.py::ExcludePathsTest::test_double_wildcard tests/unit/utils_test.py::ExcludePathsTest::test_exclude_custom_dockerfile tests/unit/utils_test.py::ExcludePathsTest::test_exclude_dockerfile_child tests/unit/utils_test.py::ExcludePathsTest::test_exclude_dockerfile_dockerignore tests/unit/utils_test.py::ExcludePathsTest::test_no_dupes tests/unit/utils_test.py::ExcludePathsTest::test_no_excludes tests/unit/utils_test.py::ExcludePathsTest::test_question_mark tests/unit/utils_test.py::ExcludePathsTest::test_single_and_double_wildcard tests/unit/utils_test.py::ExcludePathsTest::test_single_filename tests/unit/utils_test.py::ExcludePathsTest::test_single_filename_leading_dot_slash tests/unit/utils_test.py::ExcludePathsTest::test_single_filename_trailing_slash tests/unit/utils_test.py::ExcludePathsTest::test_single_subdir_single_filename tests/unit/utils_test.py::ExcludePathsTest::test_single_subdir_wildcard_filename tests/unit/utils_test.py::ExcludePathsTest::test_single_subdir_with_path_traversal tests/unit/utils_test.py::ExcludePathsTest::test_subdirectory tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_exclude tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_filename_end tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_filename_start tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_subdir_single_filename tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_subdir_wildcard_filename tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_with_exception tests/unit/utils_test.py::ExcludePathsTest::test_wildcard_with_wildcard_exception tests/unit/utils_test.py::TarTest::test_tar_socket_file tests/unit/utils_test.py::TarTest::test_tar_with_directory_symlinks tests/unit/utils_test.py::TarTest::test_tar_with_empty_directory tests/unit/utils_test.py::TarTest::test_tar_with_excludes tests/unit/utils_test.py::TarTest::test_tar_with_file_symlinks tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_shoud_check_parent_directories_of_excluded tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_should_check_directory_not_excluded tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_should_check_excluded_directory_with_exceptions tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_should_check_subdirectories_of_exceptions tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_should_not_check_excluded_directories_with_no_exceptions tests/unit/utils_test.py::ShouldCheckDirectoryTest::test_should_not_check_siblings_of_exceptions tests/unit/utils_test.py::FormatEnvironmentTest::test_format_env_binary_unicode_value tests/unit/utils_test.py::FormatEnvironmentTest::test_format_env_no_value