update npm dependencies; migrate to express 4