It seems that we currently allow reading (`get_user_email_alerts`), updating (`add_email_course_alert`), and deleting (`delete_email_course_alert`) alerts for any user simply by specifying their `user_id`. What is the use case for this?

I think we should allow the user to access/modify only their alerts.