Updating express and qs deps

See https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking and https://nodesecurity.io/advisories/qs_dos_memory_exhaustion

I kept the **express** dependency on the latest 3.x branch, which still has the latest **qs** fixes.