Do not expose auth_field when BANDWIDTH_SAVER is off.

- Have BANDWIDTH_SAVER = False so POST/PUT/PATCH responses provide the
whole document.
- Have User-Restricted Resource Access feature active, and custom auth
class is correctly setting the auth_field value.
- Have auth_field not listed in the resource schema (which is the
common situation as you usually don't want to show the value of this
internal field to the client)
- Perform a POST or PUT request

In the above scenario the auth_field would still be included with the
response.