rendered form tag has 2 id attributes

Create a new node (eg, story node) as an unauthenticated user, and you will see two id attributes in the html source: 'id="node_form"' and 'id="story_node_form"'.

As far as I can tell, this only happens with anonymous posts. This might be related to other reported issues/questions (ie, the array_merge issue, the globals issue), but i can't tell how these might be operative in the authenticated/non-authenticated variation.

The problem arises in part because:
- function node_form (in node.module) sets $form['#attributes']['id'] to 'node_form';
- function drupal_get_form (in form.inc) adds the specific node id via $form['#id'];
- and then function theme_form (in form.inc) sets the form tag's id via $form['#attributes']['id'] *and* calls drupal_attributes with $form['#attributes'], hence producing the second id attribute.

Again, what I don't understand is the discrepancy between authenticated and non-authenticated rendering. But I haven't studied the forms api documentation further yet, to find out, for example, if node_form should be specifying the html attribute via ['#attributes'], if theme_form should be retrieving the html attribute via ['#id'], what's a red herring and what's not, etc.

My interim kludge is a modification to theme_form, using an $id variable analogously to the $action variable: if $form['#id'] is set use that for $id; else if $form['#attributes']['id'] is set use that for $id; else fall back to hard-coded 'node_form' (i'm reaching here); and then make sure that $form['#attributes']['id'] is *un*set before the call to drupal_attributes.

But what i'd really love to know is why the authenticated/non-authenticated variation happens in the first place. I'm speculating all over the place, but really i'm just groping at the moment ....