use res.set instead of res.setHeader to fix express 4 compatibility

I'm not actually sure whether setHeader was ever a supported call but it certainly
no longer works properly in express 4.