Lock request module

The new version of request 2.18.0 uses verson 0.3.0 of tunnel-agent which is breaking things so I'm locking this to version 2.16.6 for now.