update and lock down client dependencies
use correct path for karma script
only use phantomjs when running client tests from make, because we don't know what browsers the user has installed