Several updates.

1. Upgrade express from 3.x to 4.x.
2. Add custom error controller.
3. Refine session middleware to support query-based session.