pinning mongoose and node-validator (latest packages have breaking api changes)