enrollment tests and cleanup

Many, many, many tests. Pep8 cleanup, some additional validation. Includes separation of data.py from api.py, to allow testing the API independently of the data layer. 

@wedaly @dianakhuang @rlucioni 
Never mind, I see that this is coming from the user object added to the request.