Update express dep to use ^ and set default version to known patched.

To address the [qs security advisory](https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking) kraken@0.7 needs dependencies updated to include patched version. This will result in a 0.7.4 release.