A user with `is_staff=True` is treated as being in all groups. This is problematic
when we care about the user's staff/instructor role for a course: you can't remove
the instructor role. This commit changes the `is_user_in_course_group_role` function
to allow the caller to specify that it should not check the `is_staff` attribute
on the user.

Includes unit tests and modifications to authz.py.

Also hooks up the granted and deny events to the course creator group.

fix up some thumbnail issues. Also we need to manage the user permissions when we clone and delete course

respond to Cale pull request comments. Update access.py (LMS) to use the same 'check for legacy group name first' logic. Add SECRET_KEY setting to the CAS project so that auth tokens from CAS are accepted in the LMS

adhere to the naming conventions of user groups (instructor_* and staff_* of the LMS AuthZ implementation). While we're keeping our authz.py implementation - which is duplicative of LMS's access.py - in order to minimize code churn/risk-of-regression, there is data compatibility so the two systems will interpret the data the same way

add distinct 'admin' role separate from 'editors'. Only 'admins' should be able to add/remove editors.