added express as a dependency and fixed error in acl.js


       if (user.locked) {
                    ^
    TypeError: Cannot read property 'locked' of null

For those who clone, express wasnt listed as a dependency so it wasnt being downloaded with npm install.