update for Express 4.x (Session is a standalone module now)