upgrade express from 3.x to 4.x

I created this pull request for the review of the upgrade changes.
we should use attributes style %a(href='login') instead of hash style ...