setup.py: clamp WTForms to 1.0.5

Flask-WTF 0.9.3 requires WTForms < 2.0 but asks for WTForms >= 1.0.5