Added another legacy code condition to _fetch_xform() -- use the username+id_string lookup combination only if the request object's user is logged in