list all dependencies in requirements.txt

this locks all deps at their current versions, which gives us hope that
the future won't break us.
(except for distribute/setuptools...)