Don't crash when trying to report a missing hash on a package that's already installed. Fix #22. Bump version to 0.9.1.

Thanks to gsathya for an initial patch toward this. I just tweaked his to maintain the package order from the requirements file, so you can paste into it without disturbing any organizational scheme you had going on there.