Security fixes for App Manager

http://manage.dimagi.com/default.asp?119272
i think `@login_and_domain_required` is implicit in `@require_can_edit_apps` so you should be able to remove it from all of these.