[1.5.x] Fixed #23431 -- Allowed inline and hidden references to admin fields.

This fixes a regression introduced by the 53ff0969 security fix.

Thanks to @a1tus for the report and Tim for the review.

refs #23329.

Backport of 342ccbdd from master