don't lock down express 3.0.0
don't lock down mocha
Merge pull request #252 from tonytamsf/master

don't lock down express 3.0.0, mocha 1.7.4