Updating prod deps

[wesleytodd]

Updating ajv is a breaking change to the validation in two ways:

1. We are defaulting strict to false. The error here was confusing, and honestly we probably need a test for that mode
2. The http response data is changed for errors from dataPath to instancePath

Updating path-to-regexp is interesting because it is out of sync with express@4 which is at 0.1.7. It was always though, and since we haven't gotten any complaints about that so far I guess we should be alright?

As with the changes to the dev deps I think we are alright breaking since we are pre-1.x