have create_xform_from_xml return the xform rather than the id

saves an extra lookup everywhere that calls it
remove all references to XFORMS_POST_URL
move auth_context into initial form creation

keeps us from having to save twice