locking down express to 3.3.8 to avoid issues with 3.4.0