update dependencies
don't use deprecated form of `body-parser`