If course_id is not specified, then this will return users who have a Role with no course_id (which theoretically can exist but is probably not what we want here). For now, this should probably require that the course_id be specified and return a 400 error if it is not.