Test that we don't expose content IDs to the site.

The content ID is designed to be visible only to the publishing tools
and the content store itself, not to the site-facing (and eventually
public-facing) side of the content store.