CYOA: MOOC

This works at the moment, but will be a massive security hole once you have multiple users and can't modify every Lesson as a user. More likely, you'd end up with `current_user.lessons.find(id)`, which would scope only to the lessons that exist for that user.