Hibernate is picky about javassist, but unfortunately that
library is used by other parts of our stack (Thymeleaf!?), so
we need a policy for resolving the dependency transitively.
I fixed it to the version in Hibernate 4.3.1 (our current
best foot forward), but it will have to be updateed whenever
Hibernate is.

Fixes gh-402