Update marked dep

See https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities

(there was also a request+qs vuln that was fixed in 2.40.0, and i think recent changes in Express, which you may want to bump to 3.16.0 (or whatever is latest), which included a fix to connect+qs vuln.