Update form sharing levels

closes #322 , closes #398 
I think we should leave this name `require_auth`, it's more descriptive