tighten noauth behavior to be safe, while accepting demo_user submissions

and expand tests

fixes: http://manage.dimagi.com/default.asp?94776