upgrade to express.js 4, fix session and menu