title: Pipfile.lock version not matching installed package version
body: <p>I'm using pipenv in a new project I'm working on. Initial <code>pipenv install</code> was Django, with <strong>Pipfile</strong> showing:</p>
  
  <pre><code>[packages]
  
  django = "*"
  </code></pre>
  
  <p>and <strong>Pipfile.lock</strong> showing:</p>
  
  <pre><code>"version": "==1.11.7"
  </code></pre>
  
  <p><code>pipenv graph</code> and <code>pip list</code> (from within the pipenv virtualenv) both show that Django version 1.11.7 is installed</p>
  
  <p>However, when I do a subsequent <code>pipenv install new-package</code> the Pipfile.lock is updated to show:</p>
  
  <pre><code>"version": "==2.0"
  </code></pre>
  
  <p>for Django, even though <code>pipenv graph</code> and <code>pip list</code> both show that version 1.11.7 is still installed locally. This obviously causes problems, as the local Django version is different to that which will be installed in a fresh environment, based on the Pipfile.lock.</p>
  
  <p>It seems like <code>pipenv install new_package</code> is updating the specified version of packages which have already been installed, without updating those packages to the latest version - which seems to be counterintuitive to me. As far as I can see the only way to keep the Pipfile.lock in sync with the local environment would be to either pin all package versions in the Pipfile, or to follow up every <code>pipenv install ...</code> with a <code>pipenv update</code> - neither of which seems to be a particularly intuitive workflow.</p>
  
  <p>I haven't been able to find any documentation or useful answers online which really clarify this behaviour. Is this the expected behaviour, or am I missing something? What is the 'recommended' workflow for handling this situation using pipenv?</p>