WIP: implement group access enforcement in courseware

@andy-armstrong @cahrens 

@dmitchell @cpennington - FYI - some performance optimizations still being worked on in here, but would appreciate any feedback / guidance on the overall logic which isn't planned to change.
I'd prefer all the group access logic factored out into its own method, so that it doesn't overwhelm ```can_load```.