sanitize the name of the metric sent to timing() and increment()...

... with the rules used in librato's official statsd backend:
https://github.com/librato/statsd-librato-backend/blob/dffece631fcdc4c94b2bff1f7526486aa5bfbab9/lib/librato.js#L146
.  This should help avoid a number of scenarios where the client sends a
bad request (due to a bad metric name) and the service is forced to 400.

Also: hard-code the coffeescript version that is expected, because only
a very specific version will not cause diffs across the codebase when
the js files are built.