Bump express for __proto__ fixes

Remove extraneous qs dependency, too.