After some testing and playing, I recommend changing this to:

      User.current = User.admin
      login = "hidden-#{Password.generate_random_string(6)}"
      hidden_user = ::User.new(:auth_source_id => AuthSourceInternal.first.id,
                           :login => login,
                           :password => Password.generate_random_string(25),
                           :mail => "#{Password.generate_random_string(10)}@localhost",
                           :remote_id => login,
                           :hidden => true,
                           :katello_roles => [])
    hidden_user.save!

This ensures the current user is set when creating the hidden user and avoids 401 unauthorized from Pulp.