Update crumb dep

See https://nodesecurity.io/advisories/crumb_cors_token_disclosure