Lock dev dependency to express 3.x