basically what diana said.  views that add "courses" to the shopping cart are stanford-specific and I'm allowing GETs for now b/c it's easier to debug.  Will definitely make those require_POST when it's time.