don't lock down express 3.0.0, mocha 1.7.4