remove transitive dependencies

Flask already pulls in itsdangerous, Werkzeug and Jinja, which in turn requires markupsafe.
allow newer versions for dependencies