MA-184 Prevent student access to unreleased data through mobile API

https://openedx.atlassian.net/browse/MA-184

@gwprice @aleffert Please review.
Maybe we can add a test which just iterates through URLs trying them for users not in the course?