Pull express-combo via git in lieu of whitelisting

@caridy @imalberto That way we can also pull in express-yui via git.