nodelock.js

var twilio = require('twilio'),
    SerialPort = require("serialport").SerialPort,
    express = require('express');

var app = express();

function sendMessage(res, message) {
  var resp = new twilio.TwimlResponse();
  resp.message(message);
  res.type('text/xml');
  res.send(resp.toString());
}

var serialPort = new SerialPort("/dev/tty.usbmodem1411", {
  baudrate: 9600
});

app.use(express.bodyParser());

app.post('/sms', twilio.webhook('your auth token', { host:'foo.herokuapp.com', protocol:'https' }), function(req, res){
  if (req.body.From == "+12128675309" && req.body.Body == "ABC123") {
    console.log("verified number!");

    serialPort.once('data', function(data) {
      if (data.toString().indexOf('U') > -1) { //check if the Arduino returned a U for unlocking
        sendMessage(res, 'Unlocking!');
      }
      else if (data.toString().indexOf('L') > -1) {
        sendMessage(res, 'Locking!');
      }
      else {
        sendMessage(res, 'ERROR');
      }
      console.log('data received: ' + data);
    });

    serialPort.write("V", function(err, results) {
      if (err) {
        console.log('err ' + err);
      }
      console.log('results ' + results);
    });

  } else {
    console.log("Wrong number!");
    sendMessage(res, "Invalid number!");
  }

});

serialPort.open( function () {
  app.listen(3000);
  console.log('Listening on port 3000');
});

@drewrwilson you can install bodyParser via:
$ npm install body-parser

and change the app.use to reflect new location

I had to use req.query instead of req.body when I copied the code over, possibly because I'm using node version 0.12.5.