This isn't a tutorial exercise. It's a working app with a real backend:
Form.create(), Submission.newest(), Submission.delete()Two different people, two different URLs, one shared database. You went from "my site can't remember anything" to "someone across the internet just sent me data." That's a big jump.
Your form builder uses a capability URL — the link is the key. That works well for simple sharing. But what if you need to know who someone is, not just whether they have a link? What if you want a dashboard that only you can see, with all your forms in one place?
That's when you need login. And that's what comes next.