use ycb-based tokens like $$lib$$ instead of repeating subpaths

requires ycb@1.0.5; previously only the first token would be replaced.

the tests pass locally, forcing mojito and arrow to use ycb@1.0.5. Travis/CI won't pass until deps specify ycb@1.0.5 (currently tagged "beta" not "latest").