update package.json to explicitly say you need express 3...