- ANDROID_NDK_ROOT must be set in env
- cmake should be setting `-DANDROID_API=23`
- specify the correct android API via a define when building openssl; it
has to be in CPPFLAGS (not CFLAGS) because otherwise openssl's
configure script doesn't notice and overrides our define with the
latest API version.
- openssl configure puts $(ANDROID_NDK_ROOT) in the makefile, so we have
to be sure that we put it in the environment for the build command,
too.