Share hidden fields for authenticated user tests
Share hidden fields for authenticated user tests

This behaviour is the same for both collection-wide and per-document
requests, so pulling it out into a shared function reduces duplication.

mysociety/popit-api,mysociety/popit-api,ciudadanointeligente/popit-api,Sinar/popit-api,Sinar/popit-api