tighten noauth behavior to be safe, while accepting demo_user submissions

and expand tests