add npm lockdown; fixes issue #19

Note: scripts/lockdown comes from npm-lockdown @ 0.0.5