Convert Course to use Flask-SQLAlchemy's session.
Add client side authorization.

The client side authorization is at a coarser level than the server
side. It's just an hash containing model names mapped to a list of
operations and a boolean on whether that operation is allowed.

The list of operations:
CREATE
MANAGE
READ
EDIT
DELETE

This authorization list can be accessed at /api/authorization

Note that the list is obtained by asking Bouncer whether the user can
access a given model. And Bouncer judges you to have permission on an
operation if you have permission on that operation on any one instance
of the model. E.g.: even if you can only read your own user information,
Bouncer returns true for ensure(READ, Users).

The list of models given in the authorization list has to be updated if
you want other models to be included, see authorization.py.

Use the Authorize service to test whether a user can perform an
operation on a model. Authorize.can(operation, model name). The model
name can be obtained from the resource object using Resource.MODEL. The
MODEL constant is added to the ngResource object when the resource is
declared.
Switch to Flask logging instead of python built in