add missing express-validator to package.json