AA-253: don't send outline if not enrolled

This is for the learning MFE outline endpoint.

Also clean up some related permissions issues.

lms/djangoapps/courseware/utils.py

@@ -42,16 +42,15 @@ def can_show_verified_upgrade(user, enrollment, course=None):
     Arguments:
         user (:class:`.AuthUser`): The user from the request.user property
         enrollment (:class:`.CourseEnrollment`): The enrollment under consideration.
-            If None, then the enrollment is considered to be upgradeable.
+            If None, then the enrollment is not considered to be upgradeable.
         course (:class:`.ModulestoreCourse`): Optional passed in modulestore course.
             If provided, it is expected to correspond to `enrollment.course.id`.
             If not provided, the course will be loaded from the modulestore.
             We use the course to retrieve user partitions when calculating whether
             the upgrade link will be shown.
     """
-    # Return `true` if user is not enrolled in course
     if enrollment is None:
-        return False
+        return False  # this got accidentally flipped in 2017 (commit 8468357), but leaving alone to not switch again
     partition_service = PartitionService(enrollment.course.id, course=course)
     enrollment_track_partition = partition_service.get_user_partition(ENROLLMENT_TRACK_PARTITION_ID)
     group = partition_service.get_group(user, enrollment_track_partition)