Use bower for dependency management

We now have quite a few dependencies, which live in `app/vendor`. Better switch to bower for dependency management.