browser: stick on phantomjs 1.9.7 due to security bug

https://github.com/ariya/phantomjs/pull/12720