MA-184 Prevent student access to unreleased data through mobile API

https://openedx.atlassian.net/browse/MA-184

@gwprice @aleffert Please review.
Should fix this one too https://openedx.atlassian.net/browse/MA-194 . I just finished looking into and it's because that user is neither staff nor registered for the course.