remove test requires of Flask-Testing and Flask-Uploads
way to validate csrf data. no need for replacing SessionSecureForm, close #78. API `validate_csrf_data` for #57