Allowing username+id_string combinations to lookup XForms as a fallback to when the uuid was missing opened up a whole pandora's box.

This commit references back to the legacy code and tries to make sense of it all.