Prevent purchases of inapp on non public app (bug 1043590)

- Add form validation
- Add test
I probably said that but I just looked at the code closer and I think any product marked with ``simulate=True`` can be simulated regardless of webapp.