Update CHANGES and bump required version of Flask-Security
Bump version number to 1.6.0