fixes #22, using express-session instead of express

I haven't had a chance to test this with Express < 4, but I can confirm that it fixes Express > 4