add auth context to every form

this leaves a record of what kind of auth was used for the form
currently just in the auditing phases