Fix #2952: Pin itsdangerous to below v1

[benvand]

itsdangerous v1 has a breaking change that changes the session hashing algorithm.

Users would be signed out when an build of flask that has depended on the new itsdangerous v1.0 is released.

#2952

[ThiefMaster]

I'm not sure if "sessions are cleared once" is worth pinning to an older version, especially since it's useless without doing a new release.

[benvand]

@ThiefMaster If you're running multiple apps that share a session then the app sessions are incompatible between the apps. That's how we found out.

[ThiefMaster]

Updating all apps to the latest itsdangerous should help.

Anyway, while I still don't think we need to do a new Flask release, I do think we should pin all our dependencies to the current major versions to require an explicit Flask update to get a major version change in a dependency.

[davidism]

Closing, see linked issue for response.

[davidism]

@ThiefMaster we can discuss version pinning policies in a new issue on pallets/meta if you'd like.

[benvand]

@ThiefMaster Totally agree about pinning deps
We have a complex environment of multiple apps and allowing flasks dependencies to have breaking changes damages the interoperability of those apps.

[benvand]

Continued: https://github.com/pallets/meta/issues/25