Use course commit SHA (rather than flow session commit SHA) to determine flow permissions)
Prevent information-losing fetch