upgrade unit tests for express 4.x

* modify unit tests to work with express 4.x (modify cookie setting)
* modify app mock to use express 4.x and separate middleware
* update README to highlight the necessity of using session middleware
* add data-driven module to facilitate testing both cookie and express based session mgmt