lock down socket.io to 0.9.16 due to disconnects when using iit and ddescribe

as mentioned in #1082, karma is getting latest 0.9 version of socket.io which does not play nice with Chrome when isolating tests with iit and ddescribe. Running tests in isolation with this version of socket.io causes the browser to disconnect, effectively making iit and ddescribe unusable. Until socket.io is fixed (https://github.com/Automattic/socket.io/issues/1558) karma should lock to a more stable version of socket.io.