patch to package.json; proper express dependencies