getFormTree() returns empty form tree when unauthenticated

[nickdickinson]

This should probably not happen. I suggest we throw an error if the user receives an empty form tree as we can assume either the form does not exist or they do not have access to that form.