Upgrade `qs` to protect against security vunerability

See https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking
`^` is not compatible with all the base installed for 0.10.x. people would have to upgrade their npm just to use express, which is not always possible in certain enterprise environments. plus we don't only hard-pin external dependencies since it's too easy for them to break people's express otherwise