Try to fix package.json for Travis by restricting version of express-session and cookie to exact matches