The correct syntax would be:
requests[security] == 2.9.1
The linked docs seems to be for pip v1.1, while the latest stable version is v8.1. The latest docs for pip are here, but you have to click a few more links to get to the formatting specs for requirements (PEP 0508).