bumped nodemon to remove vulnerable event-stream dependency

[nygellyndley]

As per : https://snyk.io/blog/malicious-code-found-in-npm-package-event-stream

[ithinkihaveacat]

Thanks! Fortunately nodemon is not used in production. (Will move to a dev dependency shortly.)