HG-234 add npm shrinkwrap and manually lock bower dependencies

As we move towards production release, we should not be haphazardly updating dependencies.