User without edit rights can modify any other user's form

[tinok]

Any form created by a user (and not shared with anyone) is editable by any other user.

[jnm]

@tinok, were you checking this with kobo by chance? It looks like that account has superuser access. I tried accessing an unshared form owned by tino from my juanito account, and it failed with an ugly 500. Correcting that is tracked at #98.

[jnm]

There's a migration issue where existing users in a pre-kpi database don't get the necessary model-level permissions. It's tracked at #101. Until that's fixed, it's likely that users who aren't superusers won't be able to do anything useful on staging.