Hmm. I think we are missing some permission assertions. If this function can be called from a webapp, the interactive user (aka Mark) needs to be authenticated and authorized to add/remove people from the COURSE_CREATOR_GROUP_NAME.

I wonder if we need to assert that caller.is_staff = True here (as well as on the corresponding 'add' method)