If the user has not specified a version for npm, but there is a package-lock.json we should automatically install npm 5

Fixes #422