submission api, briefcase api - api endpoints, closes #263

closes #263 
it would be cleaner to combine this with the above line as:

```python
form_user = (username and get_object_or_404(User, username=username) or request.user
```