auto merge of #260 : alexcrichton/cargo/issue-229, r=wycats

The fingerprinting code was erroneously using all sources from a manifest when
calculating the fingerprint which meant that sources not yet downloaded were
attempted to be fingerprinted.

The correct source to fingerprint is located in the SourceId field of the
resolved PackageId.

Closes #259