the hacking means that if the instructor submit a course ID with a student email that is not in the course. as long as the instructor does not have any session, without this line the instructor can still see the page of this student on this course which is wrong!