package.json: relaxed express version spec