Harden version of mocha dependency.
Add istanbul code coverage.

Thanks to the npm_config_coverage env variable, Travis will always run coverage.
Locally, coverage will only run when the --coverage flag is passed to `npm test`.