Fix main JS entry point path

[nkbt]

This is required if we want to have automatic programmatic access from cloverfield. The fix is needed anyway, but:

if we are using global modules, then I cannot just require /Users/nkbt/.nvm/v0.10.40/node_modules/cf-package, I need an actual file, so we need to parse package.json to find out which file to require.

[ericelliott]

What's going on with the Circle CI fail?

[nkbt]

audit tool says that uglifyjs is vulnerable, but it is a sub-dependency of handlebars.