made setup.ml invocation more robust.

This PR closes #5.
also updated dependency list, and made a note about an actual source of
up-to-date dependencies.