Secure additional endpoints based on user survey access

* Abstracts a users's ability to perform an action on a survey into `users.ensureSurveyAccess`. This positions us to add more permissions
* Require authentication and permission to add and edit forms for a survey
* Add related tests