itemSearchService security done

- checks that 'course' is set as a session var and thatu ser is prof of
hte course
- checks that 'examId' is set as a session var (to confirm that request
came from itemsearch page because it only gets set there)