removing all hacks that were in place to prevent injections

`express-state`'s serialization routine can take care of all that now