* All access checks now done for the "user" param, ignoring request.user - This matters for xqueue callbacks and for instructor view of student progress * An effect of this change is that if a student couldn't see their own 'progress' tab, the course instructor won't be able to see it either