remove express from package.json, warn if enabled

but can't load express