make noauth mode (demo_user) accept only forms that only touch demo_user cases