Bump slf4j version and exclude commons-logging

Reviewed-by: chi.tang@socrata.com