Update package.json to lock versions. Update connect to use serve-static middleware (which was decoupled from connect as of v3.0