add version constraint to rally-oauth package