Use ApplicationRole.id instead of User.id in forms. This eliminates the need for the function that checks whether a user is in a given application, because looking up the application role will raise an error if the user is not.