restrict updates to user enrolled courses