Fix incorrect permission in course/data.jsp and patched security hole

The pages in web/course/* are for instructors. The appropriate
entitlement should be checked for those pages.
Bump version