This also fixes two bugs:
* A thread created by a non-privileged user in a cohorted course would
  not have group_id set
* Any user could set the endorsed field on creation of a comment