* All access checks now done for the "user" param, ignoring request.user
  - This matters for xqueue callbacks and for instructor view of student progress
* An effect of this change is that if a student couldn't see their own 'progress' tab,
  the course instructor won't be able to see it either