Update to express 4.0.0

Update to express 4.0.0.  Can someone check that what I've done with cookie-sesions is a secure way of storing the sessions (perhaps @jonathanong?)