Update package.json

The latest version of express has incompatibilities.  Specifying an older version fixes this.