Limit express dependancy to lt version 4

express up to version 3.5.1 works perfectly, but in 4.0 beta support
for configure() was dropped. This commit fixes this dependency.