Deny self-service certificates for anonymous users

Bugfix for the following condition:
When anonymous (e.g., non-registered) access is enabled for a course,
and that course also uses the /request_certificate endpoint (e.g., via
the "Grade Me" button), anonymous users could request to be graded and
given certificates.

As a matter of policy, Stanford doesn't want to give certificates to
anonymous students.

Also adds defensive error checks in several more places.
Limit sneakpeek middleware from acting on API-like request

Impose the following restrictions on setting up sneakpeek
* Has to be a GET
* Cannot be a machine callback to handler from xqueue or xblock
* Cannot be trying to list the LTI endpoints