Freeze version to Flask 0.9 as 0.10 appears to be stripping lead plus signs from posted params, resulting in failing signature validations.