upgrade express from 3.x to 4.x

I created this pull request for the review of the upgrade changes.
can you turn the secret into a config property? maybe SESSION_SECRET?