course and enrolment models

this depends on #19

1. new course model

2. course user relation model: enrolment
have to think how this interacts with instance-level permissions.