dependencies: update express-session, 1.15.6 -> 1.16.1

This is a non breaking change.

From the changelog (https://github.com/expressjs/session/blob/v1.16.1/HISTORY.md#1161--2019-04-11):
# 1.16.1 / 2019-04-11
- Fix error passing data option to Cookie constructor
- Fix uncaught error from bad session data

# 1.16.0 / 2019-04-10
- Catch invalid cookie.maxAge value earlier
- Deprecate setting cookie.maxAge to a Date object
- Fix issue where resave: false may not save altered sessions
- Remove utils-merge dependency
- Use safe-buffer for improved Buffer API
- Use Set-Cookie as cookie header name for compatibility
- deps: depd@~2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
  - perf: remove argument reassignment
- deps: on-headers@~1.0.2
  - Fix res.writeHead patch missing return value

src/package.json

@@ -40,7 +40,7 @@
     "etherpad-require-kernel": "1.0.9",
     "etherpad-yajsml": "0.0.2",
     "express": "4.16.4",
-    "express-session": "1.15.6",
+    "express-session": "1.16.1",
     "find-root": "1.1.0",
     "formidable": "1.2.1",
     "graceful-fs": "4.1.15",