This also fixes two bugs:
* A thread created by a non-privileged user in a cohorted course would
  not have group_id set
* Any user could set the endorsed field on creation of a comment

Flagging/unflagging is done by issuing a PATCH request on a thread or
comment endpoint with the "abuse_flagged" field set.

This will allow clients to determine what actions (e.g. following,
endorsing, and editing content) a user can take on a piece of content.