pin some requirements

In particular, this prevents using newer versions of flask-restful that
have broken url_for behavior.
Merge pull request #54 from mark-burnett/pin-requirements

Pin some requirements