When listing courses for which a user has "staff" level access, bypass
calls to has_access() and use a hopefully more performant and simpler
access pattern that uses only a single ORM query and far less processing
per course.
Caution: this short-circuit implementation does not handle org-level
access grants.