Automatically log in users who access third party login after trying to register for a course

This PR refactors `change_enrollment` and `enroll` so that `change_enrollment` handles only validation we'd expect in a view ("is the user logged in before trying to access this view", "is this user in the auto-register A/B test", etc), and the `enroll` method handles more "server"-y concerns (is the class already full, does the class exist, etc).

That way, the third party login flow can simply call `enroll` directly without worrying about skipping over any important checks, since we don't really have access to views midway through the third party login flow.
So I'm doing these imports here (and one similarly awkward import in `courseware/access.py`) because I really do think it's important to move the `has_access` check onto the `enroll` method directly, and unfortunately `student/roles.py` needs something from `student/roles.py` to do its thing, so this is all I can do to avoid a circular import.

If my conception of how access should work is Very Very Wrong, I'd happily reconsider how I'm doing this, but any solution that moves that `has_access` check out of `enroll` will likely be unhappy