dependency.lower() early to avoid duplicate reqs

when req has uppercase letters in it.

Fixes: GH-26