To me, this is expected and correct behavior.
Django will take the first match, not necessarily the best match. The word 'card' is contained in both 'card' and 'cards', and I believe Django uses re.match() or a similarly behaving regex parser. Since your 'card' URL is defined first, it matches. As you've shown, changing the order produces the desired result.
The real fix is to properly terminate your URL regular expressions to match as you desire so that the order doesn't matter. Try defining your URL's like this:
urlpatterns = [
url(r'card/$', views.card),
url(r'welcome/$', views.welcome),
url(r'cards/$', views.cards),
]
The extra /$ at the end indicates that the URL will end with a /. That should be enough to differentiate the requests.
See the URL dispatcher documentation:
If you aren't familiar with regular expressions, also see the Python re module documentation:
-James