update and loosen dependencies

pretty annoying to continuously update these. we'll start pining them
when you can actually use koa without --harmony
fix negotiator 3.0 change

i'm not sure if this is incorrect. people should use `accepts()`
anyways.