upgrade express from 3.x to 4.x

I created this pull request for the review of the upgrade changes.
I have tried to complete this by loading the config file before express.session. This was after changing the secret to a variable SESSION_SECRET. I will keep looking into this.