URL patterns should be anchored. SEC-367

Some notes:

* The completion API was pulled out into a new repo, but left behind a
  url() entry.  That entry used a different namespace than the
  pulled-out repo, so I had to fix the one place we used the namespace.

* Two urls couldn't be anchored because they broke tests:

    url(r'users/(?P<user_id>\w+)/followed$', views.followed_threads, name='followed_threads'),
    url(r'users/(?P<user_id>\w+)$', views.user_profile, name='user_profile'),

openedx/core/djangoapps/bookmarks/apps.py

@@ -17,7 +17,7 @@ class BookmarksConfig(AppConfig):
         PluginURLs.CONFIG: {
             ProjectType.LMS: {
                 PluginURLs.NAMESPACE: u'',
-                PluginURLs.REGEX: u'api/bookmarks/',
+                PluginURLs.REGEX: u'^api/bookmarks/',
                 PluginURLs.RELATIVE_PATH: u'urls',
             }
         },

openedx/core/djangoapps/theming/apps.py

@@ -3,7 +3,7 @@ from django.apps import AppConfig
 from openedx.core.djangoapps.plugins.constants import ProjectType, PluginURLs
 
 
-plugin_urls_config = {PluginURLs.NAMESPACE: u'theming', PluginURLs.REGEX: u'theming/'}
+plugin_urls_config = {PluginURLs.NAMESPACE: u'theming', PluginURLs.REGEX: r'^theming/'}
 
 
 class ThemingConfig(AppConfig):