this pattern is repeated elsewhere, at least in the stats viewsets list methods, we should probably abstract it into a function like:
```python
def get_permitted_xform(formid, request):
    try:
        formid = int(formid)
    except ValueError:
        xform = check_and_set_form_by_id_string(formid, request)
    else:
        xform = check_and_set_form_by_id(int(formid), request)
    if not xform:
        raise exceptions.PermissionDenied(
            _("You do not have permission to "
              "view data from this form."))

xform = get_permitted_xform(formid)
```

although, does the lack of a returned xform always mean a permission error?  what if the user passed an ID for a non-existent xform?