Disable validation and update express/request

This updates express and request to fix [this vulnerability](https://blog.liftsecurity.io/2014/08/06/denial-of-service-in-qs).

It also disabled the shrinkwrap validation so that travis tests can pass. We can reenable it when bower is updated.