fix package-lock

[bdombro]

the repo stops working when we replace the lockfile, indicating there is an issue with a deep dependency when updating even to minor versions :-(. The issue was hard to diagnose but I finally figured out it was that we configuring timeout on cookies to be higher than Express allows.

The underlying bug is avoided by using a decent timeout number and is fixed with faf1afe

Issues:

1. Config couch_httpd_auth.timeout doesn't work as expected and throws unhelpful error pouchdb/pouchdb-server#465 (comment)