web: fix too-loose yesod dependency, we require 1.2.*