make sure replacement values are strings

Express 4 introduced some kind of _locals value that could not
be converted to a primitive and would blow up when trying to
inject it into a route url.
release 0.3.11