tighten noauth behavior to be safe, while accepting demo_user submissions

expand tests
Merge pull request #2487 from dimagi/auth-403-fix

tighten noauth behavior to be safe, while accepting demo_user submissions