relax Cowboy req dep (for future)
update Plug dep (and use relaxed ver req)