I think I see, is the idea that if the user doesn't provide a form ID to the API they can search over all of their forms if they're authenticated otherwise just 10 random forms?  Maybe we shouldn't even provide this option, why not make the form ID required?