Fix minor dependency issues with express

Also pin express at version >4 to prevent future breakage.