don't lock down express 3.0.0