lock down dependencies in package.json

Yes, shrinkwrap exists too, but we should also specify the correct
things in package.json.