More elimination of hard-coded permission ids

Also some regex-related cleanup
Cleanup auth apply form not to ask redundant questions