add npm lockdown; fixes issue #19
Merge remote-tracking branch 'jrgm/issue-19'
updated lockdown versions