Should we also have a test for `hidden_authsource_restricted` which protects changes to the AuthSourceType for hidden users?