Fix express async request handler to return promise to fix error handler

[cuzzlor]

Issue

Before this change, errors thrown from verifyMultiIssuer (and presumably verifyForHost) are not caught by the inline catch callback.

Instead of calling the unauthorizedResponse request handler, the default Express error handler is called, resulting in a 500 response instead of 401 (or whatever unauthorizedResponse is written to do).

This is presumably because:

• the RequestHandler (middleware functions) verifyMultiIssuer and verifyForHost do not return a promise, even though they have async calls
• Express does no (cannot) wait for those functions to complete
• when the error is thrown, the default Express error handler handles the error, instead of the inline catch callback

Testing

• Before the change, sending in an invalid token resulted in a 500 error (the catch does not run or is run after the default Express error handler)
• After the change, sending in an invalid token results in a 401 (the catch clause is run and unauthorizedResponse sets the response to 401)

Also

Upgrade packages, mostly dev deps