make noauth mode (demo_user) accept only forms that only touch demo_user cases

(wait for tests)