The better way to do it is:
app.disable('x-powered-by');
You can also make a middleware to remove any header like so:
app.use(function (req, res, next) {
res.removeHeader("X-Powered-By");
next();
});
See more info on how to remove a header:
http://nodejs.org/api/http.html#http_response_removeheader_name