fix an annoying abstraction violation in uth

this also wasn't using locking correctly: it never released the locks
it does return the form ID: in the `X-CommCareHQ-FormID` header, which you could then use to find the touched cases.