Should keep composer.lock in the repository.

See: https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file
and
http://stackoverflow.com/a/12896850