implement static tabs. rejigger .tar.gz import to do the re-namespacing as a post-processing step as we need to retain the original url_name during the import. Also, migrate the presentation tier to use module_render.py::get_module() to better unify HTML'ifying stuff

Make LMS access depend on which course run the access is occurring in, so that permissions can be based on the course run, rather than the whole course

- architecturally slightly questionable: the preview ajax calls goes to an LMS view instead of an input type specific one.  This needs to be fixed during the grand capa re-org, but there isn't time to do it right now.
- also, I kind of like having a generic turn-a-formula-into-a-preview service available

- courseware index view now redirects to most recent chapter, or first
- simplify the view a bit

* add a url that has an extra /{position} at the end
* pass it through to get_module

* also add a check for valid location in modx_dispatch

* All access checks now done for the "user" param, ignoring request.user
  - This matters for xqueue callbacks and for instructor view of student progress
* An effect of this change is that if a student couldn't see their own 'progress' tab,
  the course instructor won't be able to see it either

- only relevant in tests due to start dates
- still irritatingly intricate logic...

* if error is in xmodule_constructor(), catch and return an ErrorModule
* if error is somewhere else in get_module(), return None

* Update all uses.

- use get_instance, not get_item
- finish the id->location rename for modx_dispatch arg

* apply policy per-course, even if multiple courses share course and org fields
* keep descriptors separate in xml store, so that if two such courses
  change the same module in different ways, it works.  Such edits will need to
  merged on CMS import...
* add get_instance(course_id, location) method to replace get_item(location).
  Update all the call sites
* tests, including a 2nd toy course with same course and org.

- now handling access control via get_module

* error modules now hidden via access control
* get_module() returns None if user doesn't have access