Use uuid as session value for public links to restrict access to just the shared form - fixes #1070