Flask-Bouncer throws 401, we want 403.

Flask-Bouncer throws 401 Authentication Required if permission checking
fails. We want it to throw 403 Forbidden instead. The 401 triggers the
login box on the UI side, even though login wouldn't help the user since
they don't have permission in the first palce. 403 is the more accurate
error to throw.

Instead of modifying the library, the Authorization module now has a
require() function that wraps Flask-Bouncer's ensure(). It'll throw a
403 Forbidden instead of a 401. Note that this means Flask-Bouncer's
requires() decoration shouldn't be used either and should just be a
require() call.
Rename Courses' enable_student_posts.

enable_student_posts is now enable_student_create_questions, which is
more descriptive as to what it actually enables.
Update example module.

No need to have 'Module' in module names.
Remove setting TESTING:True from test, minor fixes

The Flask app config variable "TESTING", when set to True, causes
Flask-Login to ignore login_required decorators. This means that the
unauthorized test cases were passing due to Flask-Bouncer throwing a
401, not because Flask-Login throws the 401. Now that we throw 403 on
Flask-Bouncer errors, the test cases broke. I've removed the TESTING
variable but not sure if it's required for other testing functionality,
so I've kept it commented with an explanation for now.

Fixed typo in question-create-partial.html.

Added missing imports in authorization.py.