pegging serve-static to ^1.5.4

`serve-static@1.5.4` (specifically, expressjs/serve-static@62194ad1dcb1828f2e0f6c91a5d9ad861e6810f3) introduced an internal change that broke our tests.