Upgrade to express 4.8.5 and cors 2.4.1.

yeah, we don't need to test the "ok" string here.