Course participants

Implementing #185 
Not sure whether `check_access` should be refactored to use cancan. Maybe outside of the scope of this PR.