Fix broken express dependency

This is not compatible with express 4.0.0, so the dependency has to be stricter.