Add support for Express 4.x

Express 4.x no longer includes most of its middleware, so the express-session object must be passed directly.