Lock express to 3.0.x