Update form sharing levels

closes #322 , closes #398 
is this comment wrong? for non-owners it filters where `require_auth=False`