update deps; switch nsp to npm audit; and fix bug 1475698 connect timeout

[g-k]

Changes:

• switch from nsp to npm audit (refs: https://bugzilla.mozilla.org/show_bug.cgi?id=1476115)
  • add package-lock.json this should fix https://github.com/mozilla/fxa-customs-server/issues/248 when customs-server is updated
  • also unlike a shrinkwrap file it isn't published, but lets devs installing this directly know which versions to install: https://docs.npmjs.com/files/package-lock.json#description
  • update deps to get npm audit passing
• add global timeout using bluebird .timeout to fix #23
• tag 4.1.0

r? @vladikoff

[coveralls]

Pull Request Test Coverage Report for Build 76

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at ?%

---

Totals
Change from base Build 57:	0.0%
Covered Lines:
Relevant Lines:	0

---

💛 - Coveralls