code: function updateAppForms(connections, options, appForms, cb) {
    var validate = validation(appForms);
    function validateParams(cb) {
      validate.has("appId","forms",cb);
    }
    validateParams(function(err) {
      if (err) {
        return cb(err);
      }
      var conn = connections.mongooseConnection;
      var appFormsModel = models.get(conn, models.MODELNAMES.APP_FORMS);
      var appId = appForms.appId;
      var forms = appForms.forms;
  
      groups.validateAppAllowedForUser(connections, options.restrictToUser, appId, function(err) {
        if (err) {
          return cb(err);
        }
  
        groups.getFormsForUser(connections, options.restrictToUser, function(err, allowedForms) {
          if (err) {
            return cb(err);
          }
  
          if (allowedForms) {
            var disallowedForms = _.difference(forms, allowedForms);
            if (disallowedForms.length > 0) {
              return cb(new Error('No permission for forms: ' + util.inspect(disallowedForms)));
            }
          }
  
          appFormsModel.findOne({appId:appId}).exec(function(err, af) {
            if (err) {
              return cb(err);
            }
            if (af) {
              af.forms = appForms.forms;
              af.save(cb);
            } else {
              var afm = new appFormsModel(appForms);
              afm.save(cb);
            }
          });
        });
      });
    });
  }
docs: /*
  updateAppForms(connections, options, appForms, cb)
  
  connections: {
  mongooseConnection: ...
  }
  
  options: {
  uri:       db connection string,
  userEmail: user email address string
  }
  
  appForms: {
  appId: id of the App
  forms: array of formIds
  }
  
  cb  - callback function (err)