Api users courses

Added Course lookup by user owner

* /api/users/:user_id/courses now lets you look at all courses owned by
  a particular user
* POST to /api/courses is now invalid for creating
* POST to /api/users/:user_id/courses is now valid for creating
* user_id field now is a member of a json serialized Course
* added 'user_two' and 'course_three' to test fixture

@edsamson