UK: force digest authentication if request has digest headers
UK: permission denied if profile require_auth is true, list only selected users forms id require auth is false, if no username permission denied
UK: tests anonymous user can still download formlist where require_auth is false
UK: use api views