I am thinking we also want to allow access to acounts with is_staff access (request.user.is_staff). Otherwise, there could be weirdness because people marked is_staff can see courses they aren't enrolled in, but they wouldn't be able to see locked assets (and they wouldn't understand why).

Please add a test for it as well.