lock version of http-proxy