Move express to devDeps, add a peerDep for express@3-4, update express API usage to use fluent style

The bulk of this PR changes express API usage to use the new fluent calling style. i.e instead of res.send(200); we update to use res.status(200).end();.

This API was originally introduced in express@3, but then fully embraced in express@4 - deprecating the original res.send(200); style (so it'll probably disappear in express@5).

These API changes mean that ACE runs just fine in express@3, and also fine in express@4, now with no warning spam \0/.

Interesting other bit is moving express out of dependencies and into peerDependencies. It turns out ACE never actually calls require("express"); except in its tests. So, there's no point installing it. Instead, peerDependency indicates which versions of express ACE will happily coexist with.