Course bugs

[Closes #77]
[Closes #76]

*Also, allows user to immediately play a suggested course

@killpack @pdougall1 
In general it's a bad idea to get in the habit of using string interpolation in `where` clauses, as this can open you up to SQL injection attacks.
```ruby
where("courses.status = 'approved' OR courses.submitter_id = ?", user.id)
```