update requirements to get rid of flask security bug