Update bundled copy of lockdown

The reason why we use a local copy of lockdown instead of using the
one from node_modules/ (as suggested in issue #3255) is that
whenever anyone "npm installs" against a specific SHA of our repo,
everything that comes over the net is checksummed.
Update dependencies for node 0.10
[travis] update the node version to test with
[travis] quoting version numbers is better

At least, that's what the examples use in the docs:

  http://about.travis-ci.org/docs/user/languages/javascript-with-nodejs/#Choosing-Node-versions-to-test-against
add cookies 0.2.1 to lockdown, required by client-sessions@0.1.1
add a status image of browserid build status
update nodemailer and dependencies to eliminate build warnings and reduce dependencies (no more iconv)