downgrade Express and install Passport for OpenID auth

Downgrade Express to 3.1.0, because under v3.5.1 the static file
index.html is no longer rendered automatically for path '/', which is
necessary for a single page app.