Specify explicit versions for every dependency

Always accept the latest version of a package isn't a good idea. For example, right now express 4.x is out, but your project can only handle express 3.x.