express ^2.2.1 using the old semver syntax

this makes it possible to install npm-registry client using an version of npm with semver@1

this change should resolve #27
and also https://github.com/dominictarr/npmd/issues/43