Fix Travis builds

[nathanielks]

Of note, I've added composer.lock to keep CI and local dependency versions in line with each other. This is ok because Composer ignores library lockfiles.