combine release/disable ajax urls into override

Combined the 'release' and 'disable' dispatch urls in handle_ajax into a
single 'override' dispatch. The new 'override' dispatch expects the user
to POST and toggles the proctor xmodule's staff_release based on the
'enabled' key (true or false) in the request data.
fix leanModal/collecstatic javascript issue

Turns out we can avoid the weird collectstatic issue (extra hash at end
of js filename) by not invoking leanModal from javascript at all.
Instead just use static namespace from 'static_content.html'
and put rel="leanModal" in the <a> DOM element that links to the modal
DOM tree via it's href attribute.
lock down proctor server API completely

Updated handle_ajax to explicitly handle each proctor server command
individually without accepting any parameters from the client. This
completely avoids users being able to interact with the proctor server
API directly. Updated the JS code to do a POST when requesting access
(TODO: proctor server still needs to be updated to require POST - for
now the proctor xmodule still uses GET under the hood until this
gets changed)