use working version of express

Signed-off-by: Joshua Rubin <jrubin@zvelo.com>