pegging serve-static to ^1.5.4

expressjs/serve-static@1.5.4 introduced an internal change that broke our tests.