remove dependency on lodash

lodash doesn't provide much over ECMAScript 5 and not worth forcing that dependency on our users