Pin WTF to being upgraded.

We're telling the flask-wtf plugin not to do csrf in a way that only 0.9 and
above understand. We could make this backward compatible, or we could bite the
bullet and push everyone towards the newer version.