Do not include or use 'pk' field in forms

Including primary keys in forms offers possible attack vectors (one of which AFAIK would be possible currently).  In the case here, they are not necessary because the component is selected via the URLs (and that is a better place for authorization, and it is presently controlled on that level). This should address the issue in #101

The second fix asks for authorization when validating submissions.