use npm shrinkwrap

address #669

The builds on accounts-latest.dev.lcip.org were failing during npm install, and to "fix" this, I hacked the post-update.js script to remote the lockdown preinstall step. *Maybe* the dependency graph for the content server is tripping up lockdown (it's not small; github's not displaying the npm-shrinkwrap.json file here, due ot size). Anyways, to get things moving, and so I can remove my hack from the dev box, this switches over to using shrinkwrap.