Pin flask-wtf to a version that works like we expect