add auth context to every form

this leaves a record of what kind of auth was used for the form
currently just in the auditing phases
test ?authtype=digest is same as default