Pin some requirements

In particular, this prevents using newer versions of flask-restful that
have broken url_for behavior.