Restore version pinning

PyJWT and iso8601 are deemed (by me) to not be likely to break
their APIs soon. These projects, being pre-1.0, don't lend themselves
to an easy range of semantic versioning.

Flask has a CHANGES files which suggests a 1.0 is coming, but doesn't
mention backward incompatibilities, so I've gone ahead and limited us
to <2 for now.