BOM stuff

* Improve `findbom.sh` a bit so it checks for UTF-16 and suppresses some output that we don't need to check like `./fakeS3` and `./node_modules`
* Removed the detected BOM at `./libs/stats.js`

Closes #494