make noauth mode (demo_user) accept only forms that only touch demo_user cases
Merge pull request #2204 from dimagi/demouser-auth

make noauth mode (demo_user) accept only forms that only touch demo_user cases