Safe case update

Previously, any form submission could update any case; this commit adds a check so that a form can only update cases in its own domain.