`self.get_redirected_url` already does `get_course_with_access`. Why not do the authorization check there?