Extend preview to support cohorted courseware

TNL-651.

Some code review has already been done on #6258. See that PR for sandbox information.
I agree that it seems odd as written. I like the notion that the caller shouldn't have to do the access check, because then it is too easy for one caller to forget to do it. I'd prefer to remove the parameter and check the role in this method, but I think we agreed that this could be a performance hit. Maybe we need to think about caching the role so that we only pay the hit once per request.