The thread list endpoint needs to restrict the set of threads it
retrieves if the course is cohorted and the user is not privileged.
This also adds an explicit default sort (by most recent activity).
This is an initial implementation that only allows retrieval of all
threads for a course and only returns an easily computed subset of the
fields that are needed, in order to keep this change from getting too
large.
JIRA: MA-641
