Add gobwebs-formguard to the public forms. So I think this includes:

• Registration
• Forgot password

If there are other forms accessible by the unauthenticated then add it there too.