Just use a pip requirements file for tracking dependencies

From the "why did I do it like that?" department: our only dependencies at this
point are python packages, so we can just rely on pip to do the dependency
tracking.

I generated dev-requirements.txt with `$ pip freeze > dev-requirements.txt`
from a working environment. It might be a Good Idea to just list flask and
scrypt without versions and just let the deps sort themselves out, but I'd
rather have it be explicit when we build out an environment for this.