This is a short function, but there's a lot to test here.  I'd start by thinking about possible paths:

1) User is logged in and has instructor access; course exists (happy path)
2) User does not have instructor access.
3) User is not logged in.
4) Course does not exist.

In addition, there are some unhappy paths to test:
1) Request is missing the "send to" parameter.
2) Request is missing the "subject" parameter.
3) Request is missing the "message" parameter.

I'd also expect at least one test with non-ASCII unicode in each of the user-specified fields (this could be your happy-path test).  In Python, using unicode incorrectly can cause exceptions, which means users will see a 500 error.  Ned gave a great talk about this: see http://nedbatchelder.com/text/unipain.html

Since this code involves JavaScript / Python integration, I'd expect one happy-path test at the UI level.  This is something I can help with, since we don't have any existing UI-level tests for the instuctor dash.