added package.json validation test
hardened against empty missing urls

some bugs/edge-cases like bad json pointers would case the recursive loaded to enter a async loop