RSVPs belong to 'sections' for purposes of class sorting

RSVP section assignment is persisted when draggy-dropping
in the Class Overview page.

Fixed glaring security hole where any logged-in user could
update any RSVP.