course_ids *are* getting passed in GET /api/v1/users/:id requests, making this a useful proxy for user requests to a particular course.