add mgmt cmd to make secure_submissions explicity false if not set

this is so we can change the default without the danger of changing any
current apps or domains