Bump express for __proto__ fixes

Remove extraneous qs dependency, too.

Also works with node 0.11.x