Make anonymous voter relations safe by default

Keep named electorate access behind explicit unmasked methods and cover anonymous result and reminder boundaries.