add mgmt cmd to make secure_submissions explicity false if not set

this is so we can change the default without the danger of changing any
current apps or domains
Merge pull request #2932 from dimagi/secure-submissions-migration

add mgmt cmd to make secure_submissions explicity false if not set