Ensure mongoose version 3.8.5 or greater is used

Due to the way node/npm looks up modules [1] when two applications
depend on the exact same version of a package, they use the exact same
package. Because mongoose uses a singleton to access model definitions,
when two applications sharing the same version of mongoose both declare
a model using the same name, the last one declared wins, and the other
one is overwritten.

By locking popit-api to 3.8.5 or greater and locking popit to 3.8.4 we
work around this issue by ensuring the two packages don't share the same
mongoose module.

Ultimately the Popolo type models will be removed (#264), once that
happens there should no longer be conflicts between models names, so
at that point popit and popit-api will be able to use the same version
of mongoose.

[1] https://npmjs.org/doc/files/npm-folders.html#Cycles-Conflicts-and-Folder-Parsimony