replace express-state with serialize-javascript

This update should remove a couple lines of code, reduce 60kb dependency to 20kb, but most importantly, make this implementation no longer depend on Express.
`serialize()` only takes one argument.