don't fix strict version on flask-security