add itsdangerous into requirements.txt
tested on Go v1.2.2 for now