Share hidden fields for authenticated user tests

This behaviour is the same for both collection-wide and per-document
requests, so pulling it out into a shared function reduces duplication.