Update crumb dep

See https://nodesecurity.io/advisories/crumb_cors_token_disclosure
Merge pull request #4 from pdehaan/patch-1

Update crumb dep