Update README.md to use dep ensure rather than go get

[jcoyne]

Fixes #111

[aaron-collier]

Is the -vendor-only flag necessary?

[jcoyne]

Yes, otherwise it’ll recalculate the dependencies rather than use what we have tested locally, which is specified by the lock file.

[cmharlow]

No, this is exactly the opposite of what we've been working through.

[cmharlow]

Justin, have you done #94 yet? I think the rest of the group has - and I don't know if what issues you are having due to your setup are occurring for others. I'd say close this PR until you've gone through #94 and we have some more concrete, shared knowledge on usage of dep.

[jcoyne]

@cmh2166 yes I have done #94. I think that dep ensure -vendor-only is what we want someone who is newly pulling our code (and wanting to get something guaranteed to work) is going to want to do. In this way they get exactly what is in the Gopkg.lock that we know is working. If they do dep ensure it may update the lock file, causing the user to be running on libraries we haven't tested.

[jcoyne]

Here is some evidence of why dep ensure gives a user a version that is not the same as what we've developed on: #151. If you do dep ensure -vendor-only it doesn't make these changes.

[cmharlow]

Blocked by #94.