Automatically log in users who access third party login after trying to register for a course

This PR refactors `change_enrollment` and `enroll` so that `change_enrollment` handles only validation we'd expect in a view ("is the user logged in before trying to access this view", "is this user in the auto-register A/B test", etc), and the `enroll` method handles more "server"-y concerns (is the class already full, does the class exist, etc).

That way, the third party login flow can simply call `enroll` directly without worrying about skipping over any important checks, since we don't really have access to views midway through the third party login flow.
Sounds reasonable to me.