Course participants

Implementing #185 
Surely we shouldn't allow all registered users access to this data?
`check_access` happens to protect against this but this line seems wrong/redundant.