The thread list endpoint needs to restrict the set of threads it
retrieves if the course is cohorted and the user is not privileged.
This also adds an explicit default sort (by most recent activity).