lock down express version

See discussion in https://github.com/rlidwka/sinopia/issues/92#issuecomment-50764873

express.js had been sold/transferred to people who has no knowledge of how it works internally, so there is a concern that future updates will do more harm than good.

`3.15.2` will likely be last version of express 3.x as we know it, so I suggest to just lock to that.

Current express.js has no critical bugs, so there is no rush to change anything. I just propose to stop automatic updates until that thing gets resolved.