Read list of courses during authentication, if available.

Ah. I didn't realize that. For safety's sake I'd move the import into `refresh_user_course_permissions` and add a short comment noting the potential for circular imports.