This also uses a nicer implementation of `api_field_names`.

The test is changed to ensure that we are not just filtering for `safe`
or picking the last field.