lock down glob version

the new 4.1.x is breaking various tests. We'll likely want to dig in at some point to see exactly what broke, but it's blocking some things for right now.

Specifically I've determined that using `mark: true` is breaking them in the tests/unit/models/blueprint-test.js`. Something else is breaking a few smoke tests
Merge pull request #2513 from stefanpenner/glob-fix

lock down glob version