use yaml.safeLoad and support js-yaml options

https://github.com/nodeca/js-yaml#safeload-string---options-
remove unnecessary bower.json