BUG: submission: do not include or use 'pk' field in forms (fixes #101)

Including primary keys in forms offers possible attack vectors.  In the
case here, they are not necessary because the component is selected via
the URLs (and that is a better place for authorization, and it is
presently controlled on that level).
BUG: submission: require user to log in before validating submissions
Merge pull request #117 from pv/bug/ownership-check

BUG: Do not include or use 'pk' field in forms