fix permissions on Bid v2 endpoint [#186384302]

[uraniumanchor]

Contributing to the Donation Tracker

• I've added tests or modified existing tests for the change.
• I've humanly end-to-end tested the change by running an instance of the tracker.

Issue from Pivotal Tracker

https://www.pivotaltracker.com/story/show/186384302

Description of the Change

This is a more complete version of #604, I couldn't merge that one for two reasons:

• our CI doesn't let the tests pass because of a permissions check that non-collabs can't pass (we'll need to address this later)
• no tests were added or fixed that would have exposed the problem

This was fixed on the hotfix branch a while back but a) I forgot to merge it back into master and b) I never updated the tests to actually do the test correctly (they were spuriously passing because superuser, I need to go through and make sure no other tests are doing that).

Verification Process

The fix has been on the real server for a while, plus I manually verified it again locally.