check_and_set_form_by_id_string does return a 404 exception if the form does not exist, also if it returns false then it does mean that person does not have permission. I do agree on the function get_permitted_xform().