this should be scoped by `current_course` so professors can't see students from another course.