Update README.md

@kevgo 
This change encourages using npm's automatic semantic-versioning-safe version instead of latest, which could be a problem if we have breaking changes in the future.

It also makes sure mycha is added as a dev-dependency