[DO NOT MERGE] add project field to xform

what value does this class add? it seems to make things more opaque, i.e. you have to remember the state you're storing in it to know it is doing what you want, and some intermediary code could have changed that state, so be sure you also have to check the state. why not simply have clients call `publish_xml_form` directly? In the examples in this code I don't see any reason not to do that.