missed a couple newly-necessary packages

morgan and serve-static are now required explicitly because their older
selves, logger and static, no longer come with connect.