Bump express-state dependnecy to at least v1.0.1.
Merge pull request #32 from yahoo/express-state-1.0.1

Bump express-state dependency to at least v1.0.1 to close the security of the state exposed to the client side