The can:read/can:manage tests traced user->course relationships in both directions (and was causing trouble), but only one direction is enough, so I removed the reverse-relationship-walk.