locking http-browserify version