url hashes and the lockfile

[maxmcd]

• the lockfile is not updated if the derivation has been built
• the derivation doesn't contain the hash, but it's not available until after we build

do we need to fix these things? will they cause problems?