Pull express-combo via git in lieu of whitelisting

That way we can also pull in express-yui via git.