made setup.ml invocation more robust.

This should fix #5.
also updated dependency list, and made a note about an actual source of
up-to-date dependencies.