setup.py: set an upper bound on dependencies version (#352)

This should make this library more robust in case of breaking changes in one of
its dependencies.
diff --git a/setup.py b/setup.py
index 73d0f71..4e87a72 100644
--- a/setup.py
+++ b/setup.py
@@ -19,9 +19,9 @@
 
 
 DEPENDENCIES = (
-    'cachetools>=2.0.0',
+    'cachetools>=2.0.0,<3.0',
     'pyasn1-modules>=0.2.1',
-    'rsa>=3.1.4',
+    'rsa>=3.1.4,<4.0',
     'setuptools>=40.3.0',
     'six>=1.9.0',
 )
diff --git a/tox.ini b/tox.ini
index 59fd6ab..9e94666 100644
--- a/tox.ini
+++ b/tox.ini
@@ -7,7 +7,7 @@
   flask
   mock
   oauth2client
-  pytest
+  pytest<5.0
   pytest-cov
   pytest-localserver
   requests