package: Pin `mocha` and update `co-mocha`

`co-mocha` defines `mocha` as its peerDependency, so shouldn't use `*`
as our `mocha` version.  this should fix travis builds.
test: Fix 406 message assertion

Based on whether or not you have credentials or not, the error message
is slightly different.  This patch allows the test to pass in both
cases.
Merge pull request #52 from stephenmathieson/fix-co-mocha

package: Pin `mocha` and update `co-mocha`