Freeze express and connect versions in package.json

using the '>=' semver selector causes kickstart to fail with the
most recent versions of express and connect. Specifying particular
versions fixes this issue.