it was old code, it was supposed check the form permission to see if that api_user was allowed to see the question. It will be done somewhere else.