Allow urls as dependencies

The requirement that they be semver ranges is too strict.
Merge pull request #28 from isaacs/master

Allow URLs as dependencies