Update crumb and request deps

See https://nodesecurity.io/advisories/crumb_cors_token_disclosure