The checks are now within the Python API instead of the DRF view. This
will be necessary for certain operations (like fetching/editing threads)
because the relevant course cannot be known until the thread is fetched
from the comments service. This commit updates the existing endpoints to
fit that pattern.
The thread list endpoint needs to restrict the set of threads it
retrieves if the course is cohorted and the user is not privileged.
This also adds an explicit default sort (by most recent activity).
This is an initial implementation that only allows retrieval of all
threads for a course and only returns an easily computed subset of the
fields that are needed, in order to keep this change from getting too
large.
JIRA: MA-641
