All API tests are now ran with a (simulated) logged in user
Clean up todos in unit tests
Add unit tests to assert that POST and PUT honor ?fields syntax