Revert Express to 3.5.1 and pin