tighten noauth behavior to be safe, while accepting demo_user submissions

expand tests