Unauthorized forms were incorrectly visible to the user

Because authorization on forms was not correctly applied at the user level, unauthorized forms were incorrectly visible to the user.