update all deps except Flask-Security

security is not updated yet since that will also update WTF, and that will cause errors