Automatically log in users who access third party login after trying to register for a course

This PR refactors `change_enrollment` and `enroll` so that `change_enrollment` handles only validation we'd expect in a view ("is the user logged in before trying to access this view", "is this user in the auto-register A/B test", etc), and the `enroll` method handles more "server"-y concerns (is the class already full, does the class exist, etc).

That way, the third party login flow can simply call `enroll` directly without worrying about skipping over any important checks, since we don't really have access to views midway through the third party login flow.
Since lots of modules import `student`, but `student` needs `has_access` only in a particular place (the `enroll()` function), I would do the imports the other way around.  That is, move the new imports in `student` to the `enroll()` method, and let other modules import `student` at the top-level.

The deeper issue here is that `student` is doing too much work, but that will get better as we decompose the app into smaller chunks over the next few months.