- courseware index view now redirects to most recent chapter, or first
- simplify the view a bit

* add a url that has an extra /{position} at the end
* pass it through to get_module

* also add a check for valid location in modx_dispatch

* All access checks now done for the "user" param, ignoring request.user
  - This matters for xqueue callbacks and for instructor view of student progress
* An effect of this change is that if a student couldn't see their own 'progress' tab,
  the course instructor won't be able to see it either

- only relevant in tests due to start dates
- still irritatingly intricate logic...

* if error is in xmodule_constructor(), catch and return an ErrorModule
* if error is somewhere else in get_module(), return None

* Update all uses.

- use get_instance, not get_item
- finish the id->location rename for modx_dispatch arg

* apply policy per-course, even if multiple courses share course and org fields
* keep descriptors separate in xml store, so that if two such courses
  change the same module in different ways, it works.  Such edits will need to
  merged on CMS import...
* add get_instance(course_id, location) method to replace get_item(location).
  Update all the call sites
* tests, including a 2nd toy course with same course and org.

- now handling access control via get_module

* error modules now hidden via access control
* get_module() returns None if user doesn't have access

* All access control logic is now in access.py
* It exports a single method for general use: has_access(user, object, action)
 - possible actions depend on object type (e.g. 'see_exists', 'enroll', 'staff')
* Removed DARK_LAUNCH feature flag--it is now the default behavior
* Replaced check_course with three separate more focused functions that use has_access

Minor things:
* note on using pdb in testing
* moved time parsing helper into timeparse.py
* x_modules now have a .start attribute (None if not in metadata)