Updated /api/courses route to limit selection