Cartridge spec parsing does not handle deserialized JSON hashes

A hash should be treated as a hard match, not a soft spec.  Allows quickstarts to specify:

    [{'url': 'http://foo'}] 

and have it be locked to that spec (vs. trying a search)