keep dependency Express version under 4.0.0 to avoid crash