Pin Express to 3.5.0.

`*` will grab `4.0.0` which is currently not supported.