The queries in 185 and 186 roughly translate into: give me all the courses for which this user is an instructor and then all of them for which the user is staff; thus, it ensures the user has auth by backward mapping from auth to courses.