621 determine permissions from project permissions

Closes #621 
does this test pass when ```public: False``` is set in ```public_data```? I think this test is publishing a form with ```public: False```. Might need to test is publishing a form with  ```public: False``` to a public project makes the form public also.