I think we need to intersect this with $groups at this point in time, since it's "the user's groups that have view form permission" that we're concerned with.