use LESS
move session secret to config.json
upgrade to express 4.8.1