add flask-wtf to requirements and update a deprecated flask-wtf call