switch from lockdown to shrinkwrap

Now that package versions in npm are more stable (http://blog.npmjs.org/post/77758351673/no-more-npm-publish-f) I'd like to propose switching from lockdown to the built-in shrinkwrap.

Advantages:
* built-in, well doc'd, maintained
* faster install runs

Disadvantages:
* less paranoid
* checks version numbers not hash of contents
    * relies more heavily on registry.npmjs.org being secure
    * but shasum checking is on npm's todo list (https://github.com/npm/npmjs.org/issues/148#issuecomment-35143569)

I think using shrinkwrap simplifies this task *very slightly* and I feel ok with the disadvantages.