allow secure url to omit app_id

And make the following adjustments to fix side effects
- change their django url names to be consistent with non-secure ones
- change the url regex for extracting app id from submission + test
fix some whitespace
make reassign_cases use secure post (without app_id)
Merge pull request #2113 from dimagi/secure-reassign-cases

Make reassign cases use secure post