upgrade express to 4.9.x

I would consider this a minor bump, since express itself is a minor bump.